ENS Contest - Parad0x's results

Lines of code

https://github.com/code-423n4/2023-04-ens/blob/45ea10bacb2a398e14d711fe28d1738271cd7640/contracts/dnsregistrar/RecordParser.sol#L14-L40

Vulnerability details

Impact

The return value of readKeyValue could be incorrect in some cases.

The primary issue stems from the function's assumption that if it cannot locate the terminator within the range [offset, offset+len), then there is no terminator in the input, subsequently setting the terminator offset to input.length.

Proof of Concept

The readKeyValue() function is designed to read key and value pairs and return the offset (nextOffset) of the next key-value pair. However, there is an issue in the code implementation.

When the function tries to extract the value portion, it searches for a white space as the terminator and sets the 'terminator' variable to the offset of the terminator. If the function is unable to locate the terminator, it sets the 'terminator' variable to input.length, assuming that no terminator exists within the range [offset+len, input.length). This situation also carries the unintended consequence of potentially reading more than the designated 'len' characters specified by the input.

Tools Used

Manual review.

Recommended Mitigation Steps

terminator= offset + len; instead of terminator = input.length;