From a503ba1a0a1a5d1a434b6fca5e25ff5eca0a35fa Mon Sep 17 00:00:00 2001 From: Francisco Date: Mon, 4 Sep 2023 05:17:03 -0300 Subject: [PATCH] Avoid overflow on empty multiproof (#4564) --- .changeset/large-humans-remain.md | 5 +++++ contracts/utils/cryptography/MerkleProof.sol | 4 ++-- 2 files changed, 7 insertions(+), 2 deletions(-) create mode 100644 .changeset/large-humans-remain.md diff --git a/.changeset/large-humans-remain.md b/.changeset/large-humans-remain.md new file mode 100644 index 000000000..95b72aea4 --- /dev/null +++ b/.changeset/large-humans-remain.md @@ -0,0 +1,5 @@ +--- +'openzeppelin-solidity': patch +--- + +`MerkleProof`: Use custom error to report invalid multiproof instead of reverting with overflow panic. diff --git a/contracts/utils/cryptography/MerkleProof.sol b/contracts/utils/cryptography/MerkleProof.sol index b42a080c8..a1f5129f0 100644 --- a/contracts/utils/cryptography/MerkleProof.sol +++ b/contracts/utils/cryptography/MerkleProof.sol @@ -118,7 +118,7 @@ library MerkleProof { uint256 totalHashes = proofFlags.length; // Check proof validity. - if (leavesLen + proofLen - 1 != totalHashes) { + if (leavesLen + proofLen != totalHashes + 1) { revert MerkleProofInvalidMultiproof(); } @@ -174,7 +174,7 @@ library MerkleProof { uint256 totalHashes = proofFlags.length; // Check proof validity. - if (leavesLen + proofLen - 1 != totalHashes) { + if (leavesLen + proofLen != totalHashes + 1) { revert MerkleProofInvalidMultiproof(); }