ensdomains / ens

Implementations for ENS core functionality: The registry, registrars, and public resolvers.
https://ens.domains/
BSD 2-Clause "Simplified" License
1.16k stars 511 forks source link

Report an ENS Zero Width Joiner vulnerability- This could lead to massive scams #397

Closed 0xyicheng closed 2 years ago

0xyicheng commented 2 years ago

Problem Description

When you try to search, type: abc%E2%80%8C and you will see that abc.eth can be registered. The domain owner is different from the real abc.eth owner There are some such issues, including eth.eth, Vitalik.eth, etc. Domain name +%E2%80%8C can register almost all duplicate domain names, the front end will not display the %E2%80%8C string This may bring a lot of scams and misdirection, I hope this problem can be solved soon

Example

1

2

0xyicheng commented 2 years ago

full question

https://github.com/ensdomains/ens/issues/396