Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix write logic bug by simplifying write logic #130

Merged
merged 5 commits into from
Dec 8, 2022

Conversation

0xAlcibiades
Copy link
Member

@0xAlcibiades 0xAlcibiades commented Dec 4, 2022

This fixes an issue found during the Zellic audit by simplifying the write() function such that the condition can no longer occur.

From the auditors:

Q:

if (claimId != 0 && ((claimId >> 96) != (optionId >> 96))) {should the following scenario be reachable:

  1. call write with optionId == claimId.
  2. assume somehow we can get balanceOf[msg.sender][optionId] = 1 (optionId there since encodedClaimId = claimID = optionID)-> the function won't revert with CallerDoesNotOwnClaimId(encodedClaimId);.
  3. update a _claim[encodedClaimId]; that you shouldn't have

If all these assumptions hold and are sane enough, it could lead to some locked funds.

A:

This is a valid finding, and we were able to reproduce, and it should not be allowed, herein, we propose a fix.

Co-authored-by: Alcibiades Athens <alcibiades.eth@protonmail.com>
Co-authored-by: neodaoist <tom@loudverse.com>
@codecov-commenter
Copy link

Codecov Report

Merging #130 (8d0e3c8) into master (6c118f2) will decrease coverage by 0.16%.
The diff coverage is 94.44%.

@@            Coverage Diff             @@
##           master     #130      +/-   ##
==========================================
- Coverage   88.66%   88.49%   -0.17%     
==========================================
  Files           2        2              
  Lines         344      339       -5     
  Branches       54       52       -2     
==========================================
- Hits          305      300       -5     
  Misses         30       30              
  Partials        9        9              
Impacted Files Coverage Δ
src/OptionSettlementEngine.sol 99.05% <94.44%> (-0.03%) ⬇️

Help us with your feedback. Take ten seconds to tell us how you rate us. Have a feature suggestion? Share it here.

@0xAlcibiades 0xAlcibiades changed the base branch from master to audit-fixes December 8, 2022 22:52
Copy link
Contributor

@neodaoist neodaoist left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

src/OptionSettlementEngine.sol Outdated Show resolved Hide resolved
@0xAlcibiades 0xAlcibiades merged commit 05f8f56 into audit-fixes Dec 8, 2022
@0xAlcibiades 0xAlcibiades deleted the fix/claim_id_bug branch December 10, 2022 03:30
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants