Repository navigation
fix(dyn-abi): limit struct metadata copied by EIP-712 coercion - #1258
Conversation
Coercing a custom struct copies its name and property names into each DynSolValue::CustomStruct. A long type name and a long array of small structs could therefore allocate gigabytes from a small message. Charge those bytes against a 16 MiB budget shared across one coerce_json call and fail once it is exhausted.
👁️ Cyclops Security Review✅ Reviewed f41df0a (latest) · Coverage: partial · no open findings · report |
Coercing an EIP-712 message into a
DynSolValuecopies the struct name and property names into everyDynSolValue::CustomStruct, and resolving a type copies them into everyDynSolType::CustomStruct. Names have no length limit, so a schema likeRoot(LongName[] items)with a 64 KiBLongNameand 16,384 array elements allocates over 1 GiB of copied names from a message under 400 KiB (VER-1060).DynSolType::coerce_jsonnow charges each coerced struct's name, property names and fixed-size value against a 16 MiB budget shared across the whole call, andResolver::resolvecharges the names of every expanded struct against a 1 MiB budget. Both return an error once exhausted. This bounds the amplification without changing any public type, and coversTypedData::coerce,encode_data,hash_structandeip712_signing_hash. Real messages carry a few hundred bytes of metadata per struct, far below the limits.