Canto Identity Subprotocols contest - Emmanuel's results

Lines of code

https://github.com/code-423n4/2023-03-canto-identity/blob/main/canto-namespace-protocol/src/Namespace.sol#L144

Vulnerability details

Impact

The fuse function only allows creation of emoji typed characters due to this line in the fuse function: bytes memory charAsBytes = Utils.characterToUnicodeBytes(0, tileData.characterIndex, characterModifier);, which only accepts a _fontClass of 0 as the first parameter. This prevents creation of Names with alphanumeric character.

Proof of Concept

function testFusingOfNonEmojis() public {
        uint256 tid = buyOnePrelaunch(false);
        Namespace.CharacterData[] memory list = new Namespace.CharacterData[](
            1
        );
        list[0] = Namespace.CharacterData(tid, 0, 0);
        ns.fuse(list);
        string memory nametoregister=tokenToName(1)
        console.log(nametoregister); //always logs an emoji
    }

Tools Used

VSCode

Recommended Mitigation Steps

Use bytes memory charAsBytes = Utils.characterToUnicodeBytes(tileData.fontClass, tileData.characterIndex, characterModifier); instead of bytes memory charAsBytes = Utils.characterToUnicodeBytes(0, tileData.characterIndex, characterModifier); in the fuse function