fix: reachable panic due to out-of-memory in `modexp` precompile #689

0x3bfc · 2023-02-15T10:43:51Z

Description

The precompile may panic if the exponent length is greater than the allocable space when calling parse_bytes() to retrieve the exponent length from the input. To trigger this panic the base length and modulus length must be zero due to gas requirements.

If the exponent length is greater than isize::MAX (2^31−1 for the wasm32 platform), the modexp precompile will panic with capacity overflow.
If the exponent length is less or equal isize::MAX and there is not enough allocable space, the modexp precompile will trigger a panic.

… panics

Aurora-ClickUp · 2023-03-15T09:58:28Z

Task linked: CU-863g0ge8z AUR-07 Reachable Panic Due to Out-of-Memory

birchmd

This PR currently does not address the issue. The problem is that we eagerly allocate memory based on the lengths in the input (this happens at engine-precompiles/src/modexp.rs:70, but it's outside the diff so I can't put the comment there). I think our parsing of the lengths was fine, it's what we do with those lengths is currently a problem.

engine-precompiles/src/modexp.rs

birchmd

Nice! I like how simple this fix is, and I do think that this fixes the problem 🚀

Just some minor comments on the tests.

engine-precompiles/src/modexp.rs

engine-tests/src/benches/res/StandardPrecompiles.sol

Co-authored-by: Michael Birch <[email protected]>

birchmd

LGTM, nice work @0x3bfc

aleksuss

Overall looks good 👍🏻

engine-precompiles/src/modexp.rs

hskang9

Have you thought concatenating base with specific endian encoding method?

engine-precompiles/src/modexp.rs

vimpunk

My understanding of this part of the code is very limited so please take my questions more as my trying to learn.

engine-precompiles/src/modexp.rs

* chore: trigger `capacity overflow` and `attempt to add with overflow` panics * fix: tests and add extra edge cases tests * fix: clippy error * fix: update checks for out of memory and capacity errors * fix: revert to old gas estimate * fix: minor test refactor * fix: oom but it fails with capacity overflow * fix: add capacity error check * fix: never returns errors from precompiles * chore: clean up and add more tests * chore: more tests * refactor: zero modulus check * fix: remove unncessary check * Update engine-precompiles/src/modexp.rs Co-authored-by: Michael Birch <[email protected]> * Update engine-precompiles/src/modexp.rs Co-authored-by: Michael Birch <[email protected]> * fix: add helper function for test inputs * fix: add integration tests * Update engine-precompiles/src/modexp.rs Co-authored-by: Michael Birch <[email protected]> * Update engine-precompiles/src/modexp.rs Co-authored-by: Michael Birch <[email protected]> * Update engine-precompiles/src/modexp.rs Co-authored-by: Michael Birch <[email protected]> * Update engine-precompiles/src/modexp.rs Co-authored-by: Michael Birch <[email protected]> * Update engine-precompiles/src/modexp.rs Co-authored-by: Michael Birch <[email protected]> * Update engine-precompiles/src/modexp.rs Co-authored-by: Michael Birch <[email protected]> * fix: `StandardPrecompiles.sol` compilation errors * fix: revert to old implementation of `StandardPrecompiles` * fix: integration tests * refactor: `generate_modexp_test_input` * fix: adding struct for test input --------- Co-authored-by: Michael Birch <[email protected]>

@birchmd

## [2.9.0] 2023-04-05 ### Added - Enabled XCC for mainnet release by [@birchmd]. ([#694]) - Added `set_owner` contract method which sets the owner of the contract by [@hskang9]. ([#690]) - New variant of submit function `submit_with_args` which accepts additional arguments along with the transaction such as the max gas price a user is ready to pay by [@aleksuss]. ([#696]) - Added the ability to create and fund XCC sub-accounts from external NEAR accounts by [@birchmd]. ([#735]) ### Changes - Replaced `rjson` with `serde_json` by [@aleksuss]. ([#677]) - Changed owner intended contract methods to now require owner or the contract itself by [@hskang9]. ([#676]) ### Fixes - Fixed nonce incorrectly being incremented on an out of fund failure by [@joshuajbouw]. ([#671]) - Fixed a check in promise results before executing cross contract calls (XCC) callbacks by [@birchmd]. ([#693]) - Fixed a reachable panic in `receive_erc20_tokens` by [@0x3bfc]. ([#709]) - Fixed a lack of minimum size checks when instantiating a new `EthGas` object by [@lempire123]. ([#722]) - Fixed a lack of division by 0 checks in `EthGas::Div()` by [@lempire123]. ([#718]) - Fixed the validation of the return of `exports:storage_remove` by [@0x3bfc]. ([#712]) - Fixed missing account validations of NEAR account IDs by [@0x3bfc]. ([#703]) - Fixed a reachable panic in the `exitToNear` and `exitToEthereum` precompiles if the input amount is greater than 1^128 when cast from a `U256` to `u128` by [@0x3bfc]. ([#681]) - Fixed a reachable panic in `modExp` due to arithmetic overflow by [@0x3bfc]. ([#688]) - Fixed the ability attaching values to Aurora specific precompiles, this no longer is possible, by [@0x3bfc]. ([#714]) - Fixed a return error if an ecrecover signature length is not exactly 65 by [@0x3bfc]. ([#717]) - Fixed size checks on input array passed to `exitToNear` and `exitToEthereum` precompiles by [@0x3bfc]. ([#684]) - Fixed missing gas costs in `exitToNear` and `exitToEthereum` precompiles by [@lempire123]. ([#687]) - Fixed a reachable panic due to out of memory in the `modExp` precompile by [@0x3bfc]. ([#689]) - Fixed an assurance that the `sender_id` has a balance greater than the amount in `ft_transfer_call` by [@0x3bfc]. ([#708]) - Fixed returning `0x` when a length cannot be cast as `usize` instead of returning an error in the `modExp` precompile by [@birchmd]. ([#737]) - Miscellaneous minor fixes by [@0x3bfc]. ([#738]) --------- Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: Leandro Casuso Montero <[email protected]> Co-authored-by: Michael Birch <[email protected]> Co-authored-by: Alexey Lapitsky <[email protected]> Co-authored-by: Oleksandr Anyshchenko <[email protected]> Co-authored-by: Alexey Lapitsky <[email protected]> Co-authored-by: Hyungsuk Kang <[email protected]> Co-authored-by: Ahmed Ali <[email protected]> Co-authored-by: lempire123 <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

0x3bfc mentioned this pull request Feb 20, 2023

fix: reachable panic due to arithmetic overflow #688

Merged

2 tasks

chore: trigger capacity overflow and attempt to add with overflow…

3c98fa7

… panics

0x3bfc force-pushed the fix/0x3bfc/audit-aur-07 branch from 2952de0 to 3c98fa7 Compare February 20, 2023 11:14

ahmed and others added 5 commits February 22, 2023 13:20

fix: tests and add extra edge cases tests

73a6d4b

Merge branch 'develop' into fix/0x3bfc/audit-aur-07

1a1bed7

Merge branch 'develop' into fix/0x3bfc/audit-aur-07

083b561

fix: clippy error

0fdc250

Merge branch 'develop' into fix/0x3bfc/audit-aur-07

642952a

ahmed added 3 commits March 17, 2023 11:27

fix: update checks for out of memory and capacity errors

45c75cf

fix: revert to old gas estimate

c0d7dd7

fix: minor test refactor

7a1b5a7

birchmd requested changes Mar 21, 2023

View reviewed changes

engine-precompiles/src/modexp.rs Outdated Show resolved Hide resolved

0x3bfc and others added 3 commits March 21, 2023 16:23

Merge branch 'develop' into fix/0x3bfc/audit-aur-07

c7d2420

fix: oom but it fails with capacity overflow

cf97350

fix: add capacity error check

dca1d2c

0x3bfc marked this pull request as ready for review March 22, 2023 13:34

0x3bfc requested a review from vimpunk as a code owner March 22, 2023 13:34

0x3bfc requested review from birchmd and aleksuss March 22, 2023 13:34

birchmd requested changes Mar 22, 2023

View reviewed changes

engine-precompiles/src/modexp.rs Outdated Show resolved Hide resolved

engine-precompiles/src/modexp.rs Outdated Show resolved Hide resolved

0x3bfc and others added 2 commits March 23, 2023 12:14

Merge branch 'develop' into fix/0x3bfc/audit-aur-07

9eb7aa6

fix: never returns errors from precompiles

0affec6

0x3bfc changed the title ~~fix: reachable panic due to out-of-memory in modexp precompile~~ fix: reachable panic due to out-of-memory in modexp precompile [WIP] Mar 23, 2023

ahmed added 4 commits March 24, 2023 08:38

chore: clean up and add more tests

eae6dd4

chore: more tests

202a90c

refactor: zero modulus check

f9ba325

fix: remove unncessary check

3a30ff0

0x3bfc requested a review from birchmd March 24, 2023 10:55

birchmd reviewed Mar 24, 2023

View reviewed changes

birchmd requested changes Mar 27, 2023

View reviewed changes

0x3bfc and others added 10 commits March 27, 2023 20:41

Update engine-precompiles/src/modexp.rs

074e3d8

Co-authored-by: Michael Birch <[email protected]>

Update engine-precompiles/src/modexp.rs

5e64b90

Co-authored-by: Michael Birch <[email protected]>

Update engine-precompiles/src/modexp.rs

08623e1

Co-authored-by: Michael Birch <[email protected]>

Update engine-precompiles/src/modexp.rs

0651421

Co-authored-by: Michael Birch <[email protected]>

Update engine-precompiles/src/modexp.rs

986d974

Co-authored-by: Michael Birch <[email protected]>

Update engine-precompiles/src/modexp.rs

305505a

Co-authored-by: Michael Birch <[email protected]>

fix: StandardPrecompiles.sol compilation errors

27f0fe2

fix: revert to old implementation of StandardPrecompiles

61af4ca

fix: integration tests

790d6b6

Merge branch 'develop' into fix/0x3bfc/audit-aur-07

f78acd3

0x3bfc requested a review from birchmd March 28, 2023 11:24

Merge branch 'develop' into fix/0x3bfc/audit-aur-07

0f7fd7c

birchmd approved these changes Mar 28, 2023

View reviewed changes

aleksuss approved these changes Mar 28, 2023

View reviewed changes

engine-precompiles/src/modexp.rs Outdated Show resolved Hide resolved

refactor: generate_modexp_test_input

b7116b8

hskang9 reviewed Mar 29, 2023

View reviewed changes

engine-precompiles/src/modexp.rs Outdated Show resolved Hide resolved

hskang9 approved these changes Mar 29, 2023

View reviewed changes

vimpunk suggested changes Mar 29, 2023

View reviewed changes

engine-precompiles/src/modexp.rs Show resolved Hide resolved

engine-precompiles/src/modexp.rs Outdated Show resolved Hide resolved

engine-precompiles/src/modexp.rs Show resolved Hide resolved

fix: adding struct for test input

daa1af1

0x3bfc requested a review from vimpunk March 30, 2023 10:03

vimpunk approved these changes Mar 30, 2023

View reviewed changes

birchmd added this pull request to the merge queue Mar 30, 2023

Merged via the queue into develop with commit b4eb10f Mar 30, 2023

birchmd deleted the fix/0x3bfc/audit-aur-07 branch March 30, 2023 14:55

joshuajbouw mentioned this pull request Apr 5, 2023

Release v2.9.0. #739

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix: reachable panic due to out-of-memory in `modexp` precompile #689

fix: reachable panic due to out-of-memory in `modexp` precompile #689

0x3bfc commented Feb 15, 2023 •

edited

Loading

Aurora-ClickUp commented Mar 15, 2023

birchmd left a comment

birchmd left a comment

birchmd left a comment

aleksuss left a comment

hskang9 left a comment •

edited

Loading

vimpunk left a comment

fix: reachable panic due to out-of-memory in modexp precompile #689

fix: reachable panic due to out-of-memory in modexp precompile #689

Conversation

0x3bfc commented Feb 15, 2023 • edited Loading

Description

Aurora-ClickUp commented Mar 15, 2023

birchmd left a comment

Choose a reason for hiding this comment

birchmd left a comment

Choose a reason for hiding this comment

birchmd left a comment

Choose a reason for hiding this comment

aleksuss left a comment

Choose a reason for hiding this comment

hskang9 left a comment • edited Loading

Choose a reason for hiding this comment

vimpunk left a comment

Choose a reason for hiding this comment

fix: reachable panic due to out-of-memory in `modexp` precompile #689

fix: reachable panic due to out-of-memory in `modexp` precompile #689

0x3bfc commented Feb 15, 2023 •

edited

Loading

hskang9 left a comment •

edited

Loading