Basin - 8olidity's results

Lines of code

https://github.com/code-423n4/2023-07-basin/blob/main/src/libraries/LibContractInfo.sol#L16-L26

Vulnerability details

Impact

This case is described in the comments of the getSymbol() function

if the contract does not have a symbol function, the first 4 bytes of the address are returned

But in fact, if the contract does not have the symbol() function, the first 4 bytes of the address of the contract will not be obtained

Proof of Concept

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.17;
contract poc1{
    function getSymbol(address _contract) public view returns (string memory symbol) {
        (bool success, bytes memory data) = _contract.staticcall(abi.encodeWithSignature("symbol()"));
        symbol = new string(4);
        if (success) {
            symbol = abi.decode(data, (string));
        } else {
            assembly {
                mstore(add(symbol, 0x20), shl(224, shr(128, _contract)))
            }
        }
    }
}


contract poc2{
    function symbol1() public returns (string memory symbol) {
        return "namename";
    }
}

// getSymbol(address(poc2)) => error": "Failed to decode output: null: invalid codepoint at offset 3; unexpected continuation byte (argument=\"bytes\", value=Uint8Array(0x33283581), code=INVALID_ARGUMENT, version=strings/5.7.0)"

Tools Used

vscode

Recommended Mitigation Steps

Directly truncate the first 4 bytes of the address

Assessed type

DoS