Omniscia Evergon Labs Audit

OmnichainAddresses Manual Review Findings

OmnichainAddresses Manual Review Findings

OAS-01M: Improper Prefix Specification

Description:

The PREFIX defined in the OmnichainAddresses library differs from its specification as it should contain 4 extra zero-value bytes.

Impact:

The decoding of an OmnichainAddress will be assumed as "correct" even if it has dirty bytes in the highlighted data area.

Example:

contracts/utils/OmnichainAddresses.sol
9/**
10 * OmnichainAddress structure:
11 * 0xPPPPVVRRRRRRRRRRHHHHHHHHAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
12 * - Prefix (bytes4):
13 * -- PPPP - Type prefix (0x4F41) - ASCII representation of letters "OA"
14 * -- VV - Version of OmnichainAddress specification, currently 0x00
15 * -- RR - Reserved byte
16 * - Reserved bytes (bytes4)
17 * -- RRRRRRRR - Reserved bytes (should be 0x00000000 in current specification)
18 * - Chain ID (bytes4)
19 * -- HHHHHHHH - 32 bit of chain identifier
20 * - User Address (bytes20)
21 * -- AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA - Address of the user
22 *
23 * Note: cheap conversion to `address` is possible:
24 * `address account = address(uint160(uint256(OmnichainAddress.unwrap(omnichainAddress))))`
25 * but it ignores chainid and prefix, so must be used with care
26 *
27 * !!! COMPATIBILITY REQUIREMENTS !!!
28 * - PREFIX 0x4F410000 SHOULD be used only by implementations with same OmnichainAddress structure
29 * - Requirements for other implementations:
30 * -- User Identifier MUST be persistent between compatible Data Index implementations (so that user can use same ID in all compatible implementations)
31 * -- Any of compatible Data Index implementation SHOULD be able to find owner of ID issued by any other compatible implementation
32 */
33
34/**
35 * @title OmnichainAddresses library
36 * @notice Library with utility functions to encode and decode OmnichainAddress
37 */
38library OmnichainAddresses {
39 /// @dev represent PPPPVVRR prefix
40 bytes4 internal constant PREFIX = 0x4F410000;

Recommendation:

We advise these bytes to be appended to the PREFIX data structure, ensuring decoding validation will properly validate that those data bits are empty.

Alleviation (c6b23c23d8bcd8cce85049ad959cbd711a37126b):

The prefix utilized has been updated to incorporate the expected zero bytes involved in the OmnichainAddress structure, addressing this exhibit.