search

hats-finance / Thorn-protocol-0x1286ecdac50215a366458a14968fbca4bd95067d

GNU General Public License v3.0
0 stars 0 forks source link

Using abi.encodePacked can lead to hash collisions #56

Open hats-bug-reporter[bot] opened 1 month ago

hats-bug-reporter[bot] commented 1 month ago

Github username: -- Twitter username: -- Submission hash (on-chain): 0xa274005579d87c1fa724917eacb5ac328cbfe94f52a872fb55bb46cc4b0df23b Severity: low

Description: Description\ LP and stableswap factories use abi.encodePacked which can lead to collisions. Attack Scenario\

From solidity docs:

If you use keccak256(abi.encodePacked(a, b)) and both a and b are dynamic types, it is easy to craft collisions in the hash value by moving parts of a into b and vice-versa. More specifically, abi.encodePacked("a", "bc") == abi.encodePacked("ab", "c").

Attachments

  1. Proof of Concept (PoC) File

  2. Revised Code File (Optional) Use abi.encode instead of abi.encodePacked

omega-audits commented 1 month ago

From the solidity docs:

and both a and b are dynamic types,