search

hats-finance / illuminex-0x0bb4aa1f58719707405c231fcdf0b405714799cf

0 stars 1 forks source link

USAGE OF ABI ENCODEPACKED and KECCAK256 may lead to hash collision #6

Open hats-bug-reporter[bot] opened 3 months ago

hats-bug-reporter[bot] commented 3 months ago

Github username: @@giorgiodalla Twitter username: 0xAuditism Submission hash (on-chain): 0xc54c22bf4689dc629e0450b92b91ba519b7de8418ecec7b21fd355829d8c3dcd Severity: low

Description: Description\ Using abi.encodePacked() with multiple variable length arguments can, in certain situations, lead to a hash collision.

Attack Scenario\ Describe how the vulnerability can be exploited.

Attachments

  1. Proof of Concept (PoC) File

In the computeNocne we can see such occurence.

nonce = keccak256(abi.encodePacked(keyIndex, nonceConst));
  1. Revised Code File (Optional) Use abi.encode() instead which will pad items to 32 bytes, which will prevent hash collisions (e.g. abi.encodePacked(0x123,0x456) => 0x123456 => abi.encodePacked(0x1,0x23456)
- nonce = keccak256(abi.encodePacked(keyIndex, nonceConst));
+ nonce = keccak256(abi.encode(keyIndex, nonceConst));