Welcome back to Sherlock’s Vulnerability Spotlight, where we highlight an impactful vulnerability uncovered during a Sherlock audit.
This week, we examine a denial-of-service found in the @GMX_IO contest by @0xdeadbeef____ and @IllIllI000.
Credit to @int0x1catedCode for the breakdown.
Summary of the Vulnerability:
The vulnerability allows an attacker to manipulate order execution flow by providing fake revert reason lengths that don't match the actual data. This causes the protocol's error handling to read incorrect memory regions, potentially disrupting the execution process or causing unexpected behavior when processing failed orders.
Attack Steps:
1. Setup Phase
Deploy a malicious contract that implements custom revert behavior
The malicious contract should be invokable by the target protocol (e.g., as callback handler).
2. Craft Malicious Revert Data
Structure revert data with a falsified length parameter.
3. Execute Order Through Protocol
Create an order that will trigger interaction with the malicious contract
When the protocol processes the order and calls the malicious contract, it reverts with the crafted data.
The protocol's error handling attempts to decode the revert reason using the fake length.
4. Trigger Memory Read Overflow
The protocol reads memory based on the fake length parameter
This causes it to read beyond the actual revert data boundaries.
What's the Impact?
Denial of Service: Orders can fail to execute properly, blocking legitimate protocol operations like liquidation of bad positions
Order execution disruption: Batch order processing can be halted, affecting multiple users
Gas griefing: Processing malformed revert data can consume excessive gas
The Root Cause:
1. Unchecked length parameters: The protocol trusts the length value provided in revert data without validation
2. Missing boundary checks: No verification that the claimed length matches the actual data size
The Mitigation:
1. Always validate Revert Data Length
2. Implement Maximum Length Limits
We are proud to have helped secure @GMX_IO through this discovery.
When it absolutely needs to be secure, Sherlock is the right choice.
2,343
12
本页面内容由第三方提供。除非另有说明，欧易不是所引用文章的作者，也不对此类材料主张任何版权。该内容仅供参考，并不代表欧易观点，不作为任何形式的认可，也不应被视为投资建议或购买或出售数字资产的招揽。在使用生成式人工智能提供摘要或其他信息的情况下，此类人工智能生成的内容可能不准确或不一致。请阅读链接文章，了解更多详情和信息。欧易不对第三方网站上的内容负责。包含稳定币、NFTs 等在内的数字资产涉及较高程度的风险，其价值可能会产生较大波动。请根据自身财务状况，仔细考虑交易或持有数字资产是否适合您。