1inch/solidity-utils

Utility Library for Smart Contracts and Testing

This repository is a comprehensive toolkit designed to streamline and optimize the development, tests and management of smart contracts. This repository serves as a one-stop resource for developers working on Ethereum and EVM-compatible blockchain projects, offering a blend of Solidity contracts with various utilities and optimizations, alongside JavaScript tools for testing, documentation, and project management.

Features

• Development and Testing: The tools and utilities provided in this section are designed to aid in the development and testing of smart contracts. They help avoid the duplication of helper methods across different repositories by centralizing commonly used functions and scripts. This not only streamlines the development process but also ensures that the latest versions of these helpers are readily available and consistently used throughout your projects. Leveraging these utilities can significantly enhance efficiency and maintainability of your smart contract code.

• Documentation and Utilities: A suite of functionalities for generating documentation and additional utilities to enhance development workflow.

• Configuration and Management: Tools for setting up Hardhat network configurations and managing project settings efficiently.

• Solidity Contracts and Libraries: Frequently used smart contracts, libraries, and interfaces aimed at providing reusable code for common use cases, alongside optimizations to improve contract efficiency.

Contributing

Contributions are welcome! If you have a suggestion that would make this repository better, or if you have any questions, please feel free to fork the repo and create a pull request. You can also simply open an issue with your suggestion or question.

solidity-utils's Issues

https://github.com/1inch/solidity-utils/blob/master/contracts/libraries/AddressArray.sol

https://github.com/1inch/solidity-utils/blob/master/contracts/libraries/AddressArray.sol

BySig vulnerable to replay for failed transactions

The BySig contract uses functionDelegateCall from OpenZeppelin's Address to perform a call to the contract after setting a new message sender and using up the nonce specified in the call:

solidity-utils/contracts/mixins/BySig.sol

Lines 62 to 72 in 98259b2

	function bySig(address signer, SignedCall calldata sig, bytes calldata signature) public payable returns(bytes memory ret) {
	if (block.timestamp > sig.traits.deadline()) revert DeadlineExceeded(); // solhint-disable-line not-rely-on-time
	// Using _msgSender() in the next line allows private relay execution redelegation
	if (!sig.traits.isRelayerAllowed(_msgSender())) revert WrongRelayer();
	if (!_useNonce(signer, sig.traits, sig.data)) revert WrongNonce();
	if (!ECDSA.recoverOrIsValidSignature(signer, hashBySig(sig), signature)) revert WrongSignature();
	_msgSenders.push(signer);
	ret = address(this).functionDelegateCall(sig.data);
	_msgSenders.pop();
	}

However, since functionDelegateCall will automatically revert on call fail, all the state changes, specifically, those related to nonces, will be reverted, and this call will be up for a replay attack. This is especially critical when the call depends on some internal contract state that might change and the replayed call will go through successfully, but not as the initial caller intended.

A report of this kind of vulnerability with a POC is available here: code-423n4/2022-03-rolla-findings#45

#rootFile.sol import '@1inch/otherproject/contracts/dependency.sol' #@1inch/otherproject/contracts/dependency.sol import 'helpers/helper.sol'