Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Implement overflow checks when encoding uint public function args #12221

Open
benesjan opened this issue Feb 24, 2025 · 0 comments
Open

Implement overflow checks when encoding uint public function args #12221

benesjan opened this issue Feb 24, 2025 · 0 comments
Labels
A-security Area: Relates to security. Something is insecure. T-bug Type: Bug. Something is broken. team-fairies Nico's team

Comments

@benesjan
Copy link
Contributor

benesjan commented Feb 24, 2025

When a contract accepts an unsigned integer as a function argument of a public function the input value is not range checked.

This is because Noir will range constrain any inputs as specified in the ABI however public functions all share the same entrypoint (public_dispatch) so they cannot use this mechanism (as there's N different mutually exclusive ABI checks that would need to be applied). For this reason public_dispatch currently just calls the Deserialize trait which doesn't perform range checks.

For private function the range check is performed by Noir.

See this discussion for more context.

@benesjan benesjan added team-fairies Nico's team A-security Area: Relates to security. Something is insecure. T-bug Type: Bug. Something is broken. labels Feb 24, 2025
@benesjan benesjan changed the title Ensure there are overflow checks when encoding uint function args Ensure there are overflow checks when encoding uint public function args Feb 24, 2025
@benesjan benesjan changed the title Ensure there are overflow checks when encoding uint public function args Implement overflow checks when encoding uint public function args Feb 24, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
A-security Area: Relates to security. Something is insecure. T-bug Type: Bug. Something is broken. team-fairies Nico's team
Projects
None yet
Development

No branches or pull requests

1 participant