Omniscia Evergon Labs Audit
OmnichainAddresses Manual Review Findings
OmnichainAddresses Manual Review Findings
OAS-01M: Improper Prefix Specification
| Type | Severity | Location |
|---|---|---|
| Logical Fault | ![]() | OmnichainAddresses.sol:L17, L40 |
Description:
The PREFIX defined in the OmnichainAddresses library differs from its specification as it should contain 4 extra zero-value bytes.
Impact:
The decoding of an OmnichainAddress will be assumed as "correct" even if it has dirty bytes in the highlighted data area.
Example:
contracts/utils/OmnichainAddresses.sol
9/**10 * OmnichainAddress structure:11 * 0xPPPPVVRRRRRRRRRRHHHHHHHHAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA12 * - Prefix (bytes4):13 * -- PPPP - Type prefix (0x4F41) - ASCII representation of letters "OA"14 * -- VV - Version of OmnichainAddress specification, currently 0x0015 * -- RR - Reserved byte16 * - Reserved bytes (bytes4)17 * -- RRRRRRRR - Reserved bytes (should be 0x00000000 in current specification)18 * - Chain ID (bytes4)19 * -- HHHHHHHH - 32 bit of chain identifier20 * - User Address (bytes20)21 * -- AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA - Address of the user22 *23 * Note: cheap conversion to `address` is possible:24 * `address account = address(uint160(uint256(OmnichainAddress.unwrap(omnichainAddress))))`25 * but it ignores chainid and prefix, so must be used with care26 *27 * !!! COMPATIBILITY REQUIREMENTS !!!28 * - PREFIX 0x4F410000 SHOULD be used only by implementations with same OmnichainAddress structure29 * - Requirements for other implementations:30 * -- User Identifier MUST be persistent between compatible Data Index implementations (so that user can use same ID in all compatible implementations)31 * -- Any of compatible Data Index implementation SHOULD be able to find owner of ID issued by any other compatible implementation32 */33
34/**35 * @title OmnichainAddresses library36 * @notice Library with utility functions to encode and decode OmnichainAddress37 */38library OmnichainAddresses {39 /// @dev represent PPPPVVRR prefix40 bytes4 internal constant PREFIX = 0x4F410000;Recommendation:
We advise these bytes to be appended to the PREFIX data structure, ensuring decoding validation will properly validate that those data bits are empty.
Alleviation (c6b23c23d8bcd8cce85049ad959cbd711a37126b):
The prefix utilized has been updated to incorporate the expected zero bytes involved in the OmnichainAddress structure, addressing this exhibit.
