Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[SECURITY] Arithmetic operation overflow in SELFDESTRUCT opcode #1147

Open
pventuzelo opened this issue Nov 12, 2024 · 0 comments
Open

[SECURITY] Arithmetic operation overflow in SELFDESTRUCT opcode #1147

pventuzelo opened this issue Nov 12, 2024 · 0 comments

Comments

@pventuzelo
Copy link

Our team (@FuzzingLabs) discovered a bug was identified in the op_selfdestruct function, which does not check for any overflow.

Root cause

pub fn op_selfdestruct(
        &mut self,
        current_call_frame: &mut CallFrame,
    ) -> Result<OpcodeSuccess, VMError> {
        ...
        let mut target_account = self.get_account(&target_address);
        if target_account.is_empty() {
            gas_cost += dynamic_gas_cost;
        }
        target_account.info.balance += current_account_balance;
		...

        Ok(OpcodeSuccess::Result(ResultReason::SelfDestruct))
  }

target_account.info.balance += current_account_balance; : The value of current_account_balance has no check for overflow, causing a panic in the executor.

Step to reproduce

Add to [test](https://github.com/lambdaclass/lambda_ethereum_rust/blob/main/crates/vm/levm/tests/tests.rs) :

#[test]
fn test_arithmetic_operation_overflow_selfdestruct() {
    let mut vm = new_vm_with_bytecode(Bytes::copy_from_slice(&[50, 255]));
    let mut current_call_frame = vm.call_frames.pop().unwrap();
    vm.execute(&mut current_call_frame);
}

Backtrace

--- tests::test_arithmetic_operation_overflow_selfdestruct stdout ----
thread 'tests::test_arithmetic_operation_overflow_selfdestruct' panicked at /home/.../.cargo/registry/src/index.crates.io-6f17d22bba15001f/primitive-types-0.12.2/src/lib.rs:38:1:
arithmetic operation overflow
stack backtrace:
   0: rust_begin_unwind
             at /rustc/59e2c01c2217a01546222e4d9ff4e6695ee8a1db/library/std/src/panicking.rs:658:5
   1: core::panicking::panic_fmt
             at /rustc/59e2c01c2217a01546222e4d9ff4e6695ee8a1db/library/core/src/panicking.rs:74:14
   2: <primitive_types::U256 as core::ops::arith::AddAssign>::add_assign
             at /home/.../.cargo/registry/src/index.crates.io-6f17d22bba15001f/uint-0.9.5/src/uint.rs:1403:5
   3: ethereum_rust_levm::opcode_handlers::system::<impl ethereum_rust_levm::vm::VM>::op_selfdestruct
             at ./src/opcode_handlers/system.rs:340:9
   4: ethereum_rust_levm::vm::VM::execute
             at ./src/vm.rs:244:41
   5: lib::tests::test_arithmetic_operation_overflow_selfdestruct
             at ./tests/tests.rs:76:5
   6: lib::tests::test_arithmetic_operation_overflow_selfdestruct::{{closure}}
             at ./tests/tests.rs:72:53
   7: core::ops::function::FnOnce::call_once
             at /rustc/59e2c01c2217a01546222e4d9ff4e6695ee8a1db/library/core/src/ops/function.rs:250:5
   8: core::ops::function::FnOnce::call_once
             at /rustc/59e2c01c2217a01546222e4d9ff4e6695ee8a1db/library/core/src/ops/function.rs:250:5
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
Status: No status
Development

No branches or pull requests

1 participant