ENS Contest - 0x73696d616f's results

[L-01] missing zero address checks

The most concerning address is ens, although no actual change will me made on the real ens address, users will still spend significant amounts of gas. The other addresses will in the worst case scenario only make the transactions revert.

Ocurrences

DNSRegistrar.sol , constructor()

• previousRegistrar = _previousRegistrar;
• resolver = _resolver;
• oracle = _dnssec;
• suffixes = _suffixes;
• ens = _ens;

DNSRegistrar.sol , setPublicSuffixList(...)

• suffixes = _suffixes;

DNSSECImpl.sol, setAlgorithm(...)

• algorithms[id] = algo;

DNSSECImpl.sol, setDigest(...)

• digests[id] = digest;

Mitigation

Do zero address or code checks.

[L-02] missing anchor zero bytes check at DNSSECImpl.sol, constructor

anchors = _anchors; Would lead to InvalidProofType when trying to prove and claim, wasting gas.

[NC-01] DNSRegistrar.sol memory variables with same names as storage variables in proveAndClaimWithResolver(...)

proveAndClaimWithResolver(...)

The argument address resolver and the storage variable address public immutable resolver; have the same name.

Mitigation

Add a prefix _ to the memory resolver as in the rest of the codebase.

[NC-02] BytesUtils.sol variables not in camel case

• otheroffset
• otherlen
• selfptr
• otherptr

[NC-03] Add custom errors (or reason strings if prefered) to help debugging

BytesUtils

• https://github.com/code-423n4/2023-04-ens/blob/main/contracts/dnssec-oracle/BytesUtils.sol#L18
• https://github.com/code-423n4/2023-04-ens/blob/main/contracts/dnssec-oracle/BytesUtils.sol#L196
• https://github.com/code-423n4/2023-04-ens/blob/main/contracts/dnssec-oracle/BytesUtils.sol#L265
• https://github.com/code-423n4/2023-04-ens/blob/main/contracts/dnssec-oracle/BytesUtils.sol#L266
• https://github.com/code-423n4/2023-04-ens/blob/main/contracts/dnssec-oracle/BytesUtils.sol#L305
• https://github.com/code-423n4/2023-04-ens/blob/main/contracts/dnssec-oracle/BytesUtils.sol#L337
• https://github.com/code-423n4/2023-04-ens/blob/main/contracts/dnssec-oracle/BytesUtils.sol#L343
• https://github.com/code-423n4/2023-04-ens/blob/main/contracts/dnssec-oracle/BytesUtils.sol#L345

RRUtils

• https://github.com/code-423n4/2023-04-ens/blob/main/contracts/dnssec-oracle/RRUtils.sol#L25
• https://github.com/code-423n4/2023-04-ens/blob/main/contracts/dnssec-oracle/RRUtils.sol#L61

[NC-04] DNSSECImpl snake case owner_only different than the usual camel case in the codebase

https://github.com/code-423n4/2023-04-ens/blob/main/contracts/dnssec-oracle/Owned.sol#L9 In setAlgorithm(...) and setDigest(...)

[NC-05] now is the name of the deprecated keyword for block.timestamp

• https://github.com/code-423n4/2023-04-ens/blob/main/contracts/dnssec-oracle/DNSSECImpl.sol#L35
• https://github.com/code-423n4/2023-04-ens/blob/main/contracts/dnssec-oracle/DNSSECImpl.sol#L36
• https://github.com/code-423n4/2023-04-ens/blob/main/contracts/dnssec-oracle/DNSSECImpl.sol#L109
• https://github.com/code-423n4/2023-04-ens/blob/main/contracts/dnssec-oracle/DNSSECImpl.sol#L143

[NC-06] mock contracts such as DummyAlgorithm.sol should be under mocks folder

This is the case for mocks under the folder dnsregistrar. DummyAlgorithm