Address trail of bits issues #4
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
DefiCake
force-pushed
the
fix/tob-week-1-issues
branch
from
b56d7a8 to
a94557c
Compare
K1-R1
reviewed
Jul 12, 2023
packages/fungible-token/bridge-fungible-token/src/bridge_fungible_token.sw
Outdated
Show resolved
Hide resolved
packages/fungible-token/bridge-fungible-token/tests/utils/environment.rs
Outdated
Show resolved
Hide resolved
packages/fungible-token/bridge-fungible-token/tests/utils/environment.rs
Outdated
Show resolved
Hide resolved
Braqzen
reviewed
Jul 12, 2023
packages/fungible-token/bridge-fungible-token/src/bridge_fungible_token.sw
Outdated
Show resolved
Hide resolved
| msg.1.clone(), | ||
| )) | ||
| )); | ||
| message_nonce[0] += 1; |
There was a problem hiding this comment.
Just adding a note because I'm unsure if this is an issue. I believe this will only go up to the u8 limit so if we ever create (if we even can create that many) more than the limit then this may make the entire suite fail.
Perhaps we should add a comment stating this in case this ever becomes an issue
There was a problem hiding this comment.
Shouldn't message_nonce[0] only overflow at 2^64? message_nonce is really just 4 64bit number, right?
There was a problem hiding this comment.
I believe it's [u8; 32] under the hood
Co-authored-by: Braqzen <[email protected]>
…ures overflow checks
DefiCake
force-pushed
the
fix/tob-week-1-issues
branch
from
fb02103 to
c33d368
Compare
Braqzen
reviewed
Jul 14, 2023
packages/fungible-token/bridge-fungible-token/src/bridge_fungible_token.sw
Outdated
Show resolved
Hide resolved
| @@ -190,7 +213,11 @@ impl FRC20 for Contract { | |||
| // Storage-dependant private functions | |||
| #[storage(write)] | |||
| fn register_refund(from: b256, asset: b256, amount: b256) { | |||
| storage.refund_amounts.get(from).insert(asset, amount); | |||
| let previous_amount = U256::from(storage.refund_amounts.get(from).get(asset).try_read().unwrap_or(ZERO_B256)); | |||
| let new_amount = U256::from(amount).add(previous_amount); // U256 has overflow checks built in; | |||
There was a problem hiding this comment.
@pixelcircuits should we be doing conversions here or should we change the API to use a U256 directly (probably in another PR)?
Braqzen
reviewed
Jul 14, 2023
Co-authored-by: Braqzen <[email protected]>
Co-authored-by: Braqzen <[email protected]>
Co-authored-by: Braqzen <[email protected]>
Co-authored-by: Braqzen <[email protected]>
Braqzen
approved these changes
Jul 14, 2023
This was referenced Aug 26, 2023
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR:
Closes #5