mirror of
https://github.com/luxfi/precompile.git
synced 2026-09-24 00:26:21 +00:00
zeekay
fe4430cec6
big.Int.Uint64 and .Int64 are documented "if x cannot be represented, the result is undefined". On calldata that is not a lossy conversion to reason about, it is a value substitution, and the substitution happens twice in series: Uint64 drops everything above bit 63, and the Go conversion that follows it -- uint24(x), which is uint32(x) because uint24 is an alias -- drops everything above bit 31. A reader who checks only the first concludes the site is safe. contract.Unsigned and contract.Signed refuse a word that does not fit its declared width, once, where the bytes become a value. Six production sites use them; nothing downstream has to remember which of its arguments were bounded. DecodePoolKey read fee and tickSpacing as 24-bit fields and enforced neither. Above 2^32 the narrowing substituted: a tickSpacing word of 2^32+6 arrived as 6, and 2^32+60 produced the same pool id as 60. Between 2^24 and 2^32 the field held the caller's value faithfully while EncodePoolKeyABI wrote only its low three bytes, so Fee 3000 and Fee 2^24+3000 hash to the SAME id -- PoolKey.ID is not injective over its own Go type, and the decoder handed back a key whose fields are not the ones its id was derived from. The encoder is unchanged; changing it renames every pool that exists. What changed is that no such key can be built from calldata, which empties the collision class at the only boundary that produces PoolKeys from untrusted bytes. Same bound on the two tick fields in DecodeModifyLiquidityInput and decodePMLifecycle. Three engines narrowed INSIDE the comparison meant to bound the value, so the check did not merely miss, it inverted. A margin removal to 2^64x leverage read as leverage zero and passed; a perp open at 2^64 in hundredths did the same; increasePosition wrapped the quotient into a uint32 field that then set the liquidation price. Leverage is now compared at full width. CalculateFee clamped AFTER narrowing, so a violent enough move came out cheaper than a calm one; it clamps in 256 bits and narrows once the clamp proves it fits. GetTimeToRepayment saturates rather than wrapping a horizon into a small number of blocks. fhe declares euint128/160/256 and loads them through EncryptUint64, whose bit loop reads value>>i off a uint64 -- zero for every i above 63. The container is genuinely wider (tfheRandom fills all 256 bits), so the missing bits were not rounded away, they were encrypted AS ZERO: measured, asEuint256(2^200) decrypted to 0, and asEaddress on two addresses sharing their last eight bytes produced the same plaintext, so a homomorphic equality over encrypted addresses answered true for two different accounts. Casts to a narrower type still truncate, matching Solidity and the existing asEuint4/8/16/32 masks; what is refused is a plaintext wider than the loader, which is not a cast but a value the encryptor cannot carry. Widening it needs an EncryptBig upstream -- BitCiphertext's fields are unexported and it has no constructor from bits. Same bound on the scalar ops, once ahead of the switch rather than five times inside it. Consensus-visible: words that decoded now refuse. Fee or tickSpacing wider than 24 bits, a tick wider than int24, an FHE plaintext or scalar wider than 64 bits. Every one of them previously resolved to a different value than the caller sent. Four prior lanes had pinned three of these as characterisation tests naming themselves DEFECT, each instructing that the test be inverted when the bound arrived; they are inverted here rather than deleted, so the history of why stays legible. 24 of 24 mutations caught, no survivors. contract 100.0%, dex 99.1 -> 99.2. Both CGO settings, -count=1, -count=2 and -race.
72 lines
2.8 KiB
Go
72 lines
2.8 KiB
Go
// Copyright (C) 2019-2026, Lux Industries, Inc. All rights reserved.
|
|
// See the file LICENSE for licensing terms.
|
|
|
|
package contract
|
|
|
|
import (
|
|
"fmt"
|
|
"math/big"
|
|
)
|
|
|
|
// ErrRange reports that a 256-bit word does not fit the width its wire format
|
|
// declares for it: a fee slot that must be a uint24 holding 2^24, a tick slot
|
|
// that must be an int24 holding 2^32, an amount that must be a uint64 holding
|
|
// 2^255.
|
|
//
|
|
// It wraps ErrInvalidInput, so a caller that already refuses on
|
|
// errors.Is(err, ErrInvalidInput) keeps refusing exactly as before.
|
|
var ErrRange = fmt.Errorf("%w: out of range for its declared width", ErrInvalidInput)
|
|
|
|
// one is the shift base for the range bounds below. Never mutated.
|
|
var one = big.NewInt(1)
|
|
|
|
// Unsigned narrows x to bits, or refuses.
|
|
//
|
|
// Why this exists rather than a bare x.Uint64():
|
|
//
|
|
// big.Int.Uint64 is documented "If x cannot be represented in a uint64, the
|
|
// result is undefined." Not truncated — undefined. Today it returns the low
|
|
// word, so a calldata word of 2^32+6 arrives downstream as 6 and a word of
|
|
// 2^255 arrives as 0. Neither is an error the caller can see, and a negative x
|
|
// yields its magnitude's low word, dropping the sign entirely. So on
|
|
// attacker-chosen input the narrowing is not a lossy conversion to reason
|
|
// about, it is a value substitution.
|
|
//
|
|
// The EVM word is 256 bits. Every place a wire format declares something
|
|
// narrower — uint24, uint64, an index, a length — the word that does not fit
|
|
// is malformed input, and the honest answer is to say so where the bytes
|
|
// become a value. One refusal at the edge, so nothing downstream has to
|
|
// remember which of its arguments were bounded.
|
|
//
|
|
// bits above 64 refuses everything: the result would not fit the return type,
|
|
// and failing closed on a caller's mistake is the direction that cannot be
|
|
// exploited. bits == 0 admits only zero, which is the honest reading of a
|
|
// zero-width field.
|
|
func Unsigned(x *big.Int, bits uint) (uint64, error) {
|
|
if bits > 64 || x.Sign() < 0 || uint(x.BitLen()) > bits {
|
|
return 0, ErrRange
|
|
}
|
|
return x.Uint64(), nil
|
|
}
|
|
|
|
// Signed narrows x to a two's-complement field of bits, or refuses.
|
|
//
|
|
// The admitted span is [-2^(bits-1), 2^(bits-1)-1] — the same span the wire
|
|
// format's sign extension can express, so a word that survives this is a word
|
|
// that round-trips through its own encoding. That round-trip is the property
|
|
// an identifier derived from the field depends on; see PoolKey.ID.
|
|
//
|
|
// BitLen alone cannot decide this: -2^(bits-1) and 2^(bits-1) share a bit
|
|
// length and only one of them is in range. So the bound is compared, not
|
|
// counted.
|
|
func Signed(x *big.Int, bits uint) (int64, error) {
|
|
if bits == 0 || bits > 64 {
|
|
return 0, ErrRange
|
|
}
|
|
hi := new(big.Int).Lsh(one, bits-1)
|
|
if x.Cmp(hi) >= 0 || x.Cmp(hi.Neg(hi)) < 0 {
|
|
return 0, ErrRange
|
|
}
|
|
return x.Int64(), nil
|
|
}
|