search

hats-finance / illuminex-0x0bb4aa1f58719707405c231fcdf0b405714799cf

0 stars 1 forks source link

abi.encodePacked allows hash collision when when dynamic types are the input #4

Open hats-bug-reporter[bot] opened 2 months ago

hats-bug-reporter[bot] commented 2 months ago

Github username: @Jelev123 Twitter username: zhulien_zhelev Submission hash (on-chain): 0x339fe72a83de066e0dc2c7dbc6c191ab44213b9293a3b1cefe552374f5f9a3b3 Severity: low

Description: Description\ From the solidity documentation: https://docs.soliditylang.org/en/v0.8.17/abi-spec.html?highlight=collisions#non-standard-packed-mode > If you use keccak256(abi.encodePacked(a, b)) and both a and b are dynamic types, it is easy to craft collisions in the hash value by moving parts of a into b and vice-versa. More specifically, abi.encodePacked("a", "bc") == abi.encodePacked("ab", "c").

Proof of Concept (PoC) File

https://github.com/hats-finance/illuminex-0x0bb4aa1f58719707405c231fcdf0b405714799cf/blob/db34511e17fdf281aacef4267c300431d3ac12d7/packages/contracts/contracts/illuminex/xengine/chains/btc/BitcoinMerkleTree.sol#L25

Recommendation

Use abi.encode

rotcivegaf commented 2 months ago

Non issue, unsence, spam

Jelev123 commented 2 months ago

Its a similar issue is valid low in Palmera contest https://github.com/hats-finance/Palmera-0x5fee7541ddcd51ba9f4af606f87b2c42eea655be/issues/13

@rotcivegaf

rotcivegaf commented 2 months ago

Buffer is an array of bytes32 => _buffers[0] and _buffers[1] are bytes32, there are NO dynamic types

Jelev123 commented 2 months ago

Buffer is an array of bytes32 => _buffers[0] and _buffers[1] are bytes32, there are NO dynamic types

You're right, I was mistaken