cryptotechmaker
commented
1 month ago You're encoding the param in a wrong way.
Instead of UsdoMsgCodec.decodeArrayOfYieldBoxPermitAssetMsg(abi.encode(arrayEncoded));, it should be as follows:
bytes memory toBeDecoded;
for(uint256 i; i < 3; i++){
toBeDecoded = abi.encodePacked(toBeDecoded, abi.encodePacked(aa.target, aa.owner, aa.spender, aa.assetId, aa.deadline, aa.v, aa.r, aa.s, aa.permit));
}I have created the following test:
YieldBoxApproveAssetMsg memory aa = YieldBoxApproveAssetMsg({
target: address(0x1),
owner: address(0x2),
spender: address(0x3),
assetId: 1,
deadline: 2,
v: uint8(1),
r: bytes32(0),
s: bytes32(0),
permit: true
});
bytes memory toBeDecoded;
for(uint256 i; i < 3; i++){
toBeDecoded = abi.encodePacked(toBeDecoded, abi.encodePacked(aa.target, aa.owner, aa.spender, aa.assetId, aa.deadline, aa.v, aa.r, aa.s, aa.permit));
}
console.log("-------------- toBeDecoded %s", toBeDecoded.length);
bytes[] memory arrayEncoded = new bytes[](3);
for(uint256 i; i < 3; i++){
arrayEncoded[i] = TapiocaOmnichainEngineCodec.buildYieldBoxPermitAssetMsg(aa);
console.log("-------------- arrayEncoded[i] %s", arrayEncoded[i].length);
}
YieldBoxApproveAssetMsg[] memory decoded = TapiocaOmnichainEngineCodec.decodeArrayOfYieldBoxPermitAssetMsg(toBeDecoded);
console.log("---------- decoded length %s", decoded.length);the result is as follows:
-------------- toBeDecoded 570
-------------- arrayEncoded[i] 190
-------------- arrayEncoded[i] 190
-------------- arrayEncoded[i] 190
---------- decoded length 3
Github username: @GalloDaSballo Twitter username: GalloDaSballo Submission hash (on-chain): 0x43feee1623ef69e78b0f6bc43ea9aa63144edb8491b06749b2fe3698a34d9b91 Severity: medium
Description:
Impact
decodeArrayOfYieldBoxPermitAssetMsgdivides by 190, asserting that the length of a packedYieldBoxApproveAssetMsgis 189The actual length is:
Meaning that in decoding an array of YieldboxPermitAssets we will get the wrong values out
Test
Obtained by fuzzing the following:
Logs