mirror of
https://github.com/luxfi/graph.git
synced 2026-09-24 00:26:07 +00:00
zeekayandHanzo Dev
4e05024a06
An adversarial pass over the calldata found three more ways a crafted quote became a signable transaction. A hop address was taken as given. An address is twenty bytes and the path packs it against a uint24 with nothing marking the boundary, so a short one shifted every byte after it — and the path still parsed, as a route through pools nobody named. Width is the only thing separating the two, so both hop addresses are now checked the way the swapper already was. A quote says which chain priced it, and that was ignored. Building this chain's router call from another chain's quote addresses pools by the same numbers on a book that never quoted them, and these chains share deployment addresses, so it is a real trade at a price nobody was shown. Slippage is a percentage of an amount and lives between none of it and all of it. Below zero the factor inverted and the bound grew a minus sign; above a hundred it ran past a word. Clamping the percentage bounds both directions at one place, where the alternative was clamping every product it reaches. IsAddress is exported: whether a chain has an address to address a transaction to is one question, and the process that mounts these handlers has to ask it. Co-authored-by: Hanzo Dev <[email protected]>