Upgraded Q -> M from 143 [1663859521800]

[code423n4]

Judge has assessed an item in Issue #143 as Medium risk. The relevant finding follows:

2.ETHRegistrarController.register() can pass any "resolver" and "data" parameters , then ETHRegistrarController do "functionCall "

It is possible to pass malicious parameters example :

resolver = baseRegistrar.address, and data = baseRegistrar.register()
then will register a “weird” ens

    var tx = await controller.register(
      "testtest",
      registrantAccount,
      REGISTRATION_TIME,
      secret,
      baseRegistrar.address,        //********resolver = baseRegistrar.address *******//
      [
        baseRegistrar.interface.encodeFunctionData(      //********data = baseRegistrar.register() *******//
          "register(uint256,address,uint256)",
          [
            namehash.hash("testtest.eth"),
            registrantAccount,
            REGISTRATION_TIME * 10000,
          ]
        ),
      ],
      false,
      0,
      0,
      { value: BUFFERED_REGISTRATION_COST }
    );

Recommendation add：

        require(
            resolver != address(base) &&
            resolver != address(nameWrapper) &&
            resolver != address(this)
        );

[dmvt]

duplicate of #132