Listen to this Post
This vulnerability arises when the Bytes::slice, Vec::slice, and `Prng::gen_range` (for u64) methods in the Soroban SDK (v25.0.1 and prior) perform arithmetic on range bounds without proper overflow checks. When contracts are compiled with `overflow-checks = false` (the default for release builds), operations involving boundary values like `u32::MAX` or `u64::MAX` can silently wrap.
For example, calling `Bytes::slice(0..=u32::MAX)` calculates `u32::MAX + 1` for the end index. This addition overflows and wraps to 0, resulting in `slice(0..0)` (an empty slice) instead of the intended full-range slice. Similarly, `Prng::gen_range((Bound::Excluded(u64::MAX), Bound::Unbounded))` causes `u64::MAX + 1` to wrap to 0 for the start bound, generating numbers from `0..=u64::MAX` instead of an invalid/empty range. This silent wrap corrupts the intended data range, leading to incorrect contract state if user-controlled bounds are used.
Platform: Soroban SDK
Version: <= 25.0.1
Vulnerability: Arithmetic Overflow
Severity: Critical
Date: 2024-06-12
Prediction: Patch by 2024-07-15
What Undercode Say:
Check your contract's overflow-check configuration grep -A2 "profile.release" Cargo.toml Build contract with overflow checks enabled for safety cargo build --release --manifest-path=<your_contract>/Cargo.toml
// Example of vulnerable code pattern
fn vulnerable_slice(b: &Bytes) -> Bytes {
// If `end` can be u32::MAX, this overflows.
b.slice(0..=u32::MAX)
}
How Exploit:
An attacker could call a contract function that uses `slice` or `gen_range` with crafted input that forces an overflow on boundary values. This causes the contract to operate on a corrupted or empty data range, potentially bypassing intended logic, generating incorrect random numbers, or corrupting state silently without a trap.
Protection from this CVE:
1. Update SDK.
2. Enable `overflow-checks=true`.
3. Manually validate bounds.
Impact:
Corrupted contract state.
Silent data corruption.
Bypassed logic/reverts.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
