-
Notifications
You must be signed in to change notification settings - Fork 0
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
safeERC20Symbol() function will always revert when interating with tokens that returns bytes32 as Symbol #17
Comments
MKR isn't following the ERC20Metadata interface so it's more an issue with MKR than with Panoptic |
Picodes marked the issue as unsatisfactory: |
Hello Judge @Picodes |
@stalinMacias This could have been a NC comment but here there is no QA pool, so I'll wait for clarification from C4's team before handling this |
@Picodes Thanks for the response. I'll be looking forward to hearing what C4's team says about it. |
@liveactionllama @Picodes I've just seen that labels for final results have been assigned on reports. |
@stalinMacias following the team request I was asked to select the 3 best QA reports, and I didn't pick this one. Thanks for your understanding! |
@Picodes Thanks for the answer. I do understand. Just wondering if, since team asked to pick up 3 reports, and #38 and #30 are a dupe of each other, if this could be the 3rd one :) ? For example:
|
Unfortunately they count as distinct reports |
@Picodes okaay, all good, thanks for answering my questions 🫡 |
Lines of code
https://github.com/code-423n4/2024-06-panoptic/blob/main/contracts/libraries/PanopticMath.sol#L85-L93
Vulnerability details
Impact
Tokens that return bytes32 as a Symbol are incompatible with the FactoryNFT.
Proof of Concept
Some tokens (e.g. MKR) have metadata fields (name / symbol) encoded as bytes32 instead of a string. Such tokens will cause that all calls to
PanopticMath.safeERC20Symbol()
ends up reverting the whole tx.Coded PoC
Expand to see PoC
Add the below file under the folder test/foundry.
Run the PoC with the command
forge test --match-test test_safeERC20Symbol -vvvv
and analize the output, as expected, the two calls to the MKR mock token, (returns bytes32) causes the tx to revertTools Used
Manual Audit
Recommended Mitigation Steps
Make a low-level call to retrieve the symbol and then convert it to string.
Assessed type
ERC20
The text was updated successfully, but these errors were encountered: