Implement overflow checks when encoding uint public function args #12221
Labels
A-security
Area: Relates to security. Something is insecure.
T-bug
Type: Bug. Something is broken.
team-fairies
Nico's team
When a contract accepts an unsigned integer as a function argument of a public function the input value is not range checked.
This is because Noir will range constrain any inputs as specified in the ABI however public functions all share the same entrypoint (
public_dispatch
) so they cannot use this mechanism (as there's N different mutually exclusive ABI checks that would need to be applied). For this reasonpublic_dispatch
currently just calls theDeserialize
trait which doesn't perform range checks.For private function the range check is performed by Noir.
See this discussion for more context.
The text was updated successfully, but these errors were encountered: