Topology Manual Review Findings

TYG-01M: Discrepant Support of AbiEncoded Inline Evaluation

Type	Severity	Location
Logical Fault		Topology.sol:L55

Description:

The Topology::isInline function will discrepantly handle the AbiEncoded parameter type. In detail, a Calldata parameter type differs from an AbiEncoded parameter type solely in that it is prefixed with a 4-byte function signature.

In the latest Topology::isInline implementation, an AbiEncoded parameter type is considered inline if all its children are inline, however, the Calldata parameter type is always considered to not be inline.

This is discrepant as both types can be considered inline using the same approach (i.e. a Calldata parameter type is inline if all its arguments are statically-sized).

Impact:

It is presently possible for the Topology contract to treat an AbiEncoded type as inline incorrectly if all its elements are inline.

Example:

Copy
48function isInline(TypeTree memory node) internal pure returns (bool) {
49    ParameterType paramType = node.paramType;
50    if (paramType == ParameterType.Static) {
51        return true;
52    } else if (
53        paramType == ParameterType.Dynamic ||
54        paramType == ParameterType.Array ||
55        paramType == ParameterType.Calldata
56    ) {
57        return false;
58    } else {
59        uint256 length = node.children.length;
60
61        for (uint256 i; i < length; ) {
62            if (!isInline(node.children[i])) {
63                return false;
64            }
65            unchecked {
66                ++i;
67            }
68        }
69        return true;
70    }
71}

Recommendation:

We advise the code to treat Calldata and AbiEncoded parameter types identically and to strictly define how they should be evaluated as inline.

Alleviation (e6d315f9170dcf4c622d504bd2fb6eafbdac9b75):

The Topology::isInline function was updated to properly treat the AbiEncoded type identically to the Calldata type, addressing this exhibit in full.