search

ditto-lab / ditto

NFT Future protocol
MIT License
60 stars 3 forks source link

Prevent OOG on force transfer #82

Closed 0xbok closed 1 year ago

0xbok commented 1 year ago

We pass only 30_000 gas to ejected receiver so that it doesn't consume all gas. However, it can still cause duplicate() to go OOG by returning a large amount of data. This data gets copied in memory.

Fix is to use ExecessivelySafeCall library which doesn't copy the return data to memory.

calvbore commented 1 year ago

Nice find! I didn't know this pattern existed. Would you be able to write a test case for a large amount of return data?

0xbok commented 1 year ago

@calvbore sure, will do.

0xbok commented 1 year ago

ok, this was a false positive. Since the interface expects bytes4 in return value, only 4 bytes are copied in memory. closing.