## Summary The ` extractGenericSwapParameters function` in `CalldataVerificationFacet.sol contract` incorrectly rejects calldata of exactly 484 bytes with InvalidCallData, despite the function’s comment stating this is the minimum valid size. This occurs due to an overly restrictive length check (<= 484 instead of < 484). This flaw can disrupt critical swap parameter extraction, potentially affecting downstream integrations and user operations ## Finding Description In CalldataVerificationFacet.sol, the extractGenericSwapParameters function includes a length validation check: ``` // valid callData for a genericSwap call should have at least 484 bytes: // Function selector: 4 bytes // _transactionId: 32 bytes // _integrator: 64 bytes // _referrer: 64 bytes // _receiver: 32 bytes // _minAmountOut: 32 bytes // _swapData: 256 bytes if (data.length <= 484) { revert InvalidCallData(); } ``` ``` // Function selector: 4 bytes // _transactionId: 32 bytes // _integrator: 64 bytes // _referrer: 64 bytes // _receiver: 32 bytes // _minAmountOut: 32 bytes // _swapData: 256 bytes ``` This totals 484 bytes, implying that 484 bytes is the minimum valid length for a generic swap call . However, the condition <= 484 includes 484 bytes in the rejection criteria, causing calldata of exactly 484 bytes to revert with InvalidCallData, contradicting the comment’s intent that "at least 484 bytes" should be accepted. ##### Security Guarantees/Invariant Broken: * Correctness: The function fails to process calldata at the documented minimal valid size, breaking the guarantee that valid inputs meeting the specification are handled correctly. * Availability: Legitimate edge-case calls (exactly 484 bytes) are rejected, potentially disrupting integrations relying on this minimal size. ##### Malicious Input Propagation: While not requiring malicious intent to trigger, an attacker could exploit this by crafting calldata at or below 484 bytes to disrupt services: Input: A minimal swap call (e.g., empty integrator, referrer, callData) constructed to hit 484 bytes. Path: The calldata reaches extractGenericSwapParameters, where if (data.length <= 484) immediately reverts with InvalidCallData, halting processing. Effect: Could be used to DoS off-chain tools or integrations relying on this function, especially if they process minimal calldata inputs frequently. ## Impact Explanation Impact Assessment: high * Critical Functionality Disruption: This function is a key utility for extracting swap parameters in the LI.FI ecosystem, used by off-chain systems (e.g., frontends, monitoring tools) to parse calldata. Rejecting the documented minimum size (484 bytes) can break these systems’ ability to handle valid minimal swap calls, leading to operational failures or data inconsistencies ## Likelihood Explanation The bug is deterministic (always rejects ≤ 484 bytes) and aligns with documented behavior developers might rely on, increasing its practical relevance over a Low rating. The exact boundary is a realistic target in controlled or minimal scenarios. * Trigger: Easily triggered by any calldata of 484 bytes or less, including valid minimal inputs, making it accessible to both legitimate users and attackers targeting edge cases. ## Proof of Concept adjust the `CalldataVerificationFacet.t.sol test file` to the below test function. This passing test demonstrates the bug by showing a 484-byte calldata is incorrectly rejected with InvalidCallData. ``` // SPDX-License-Identifier: MIT pragma solidity ^0.8.17; import {CalldataVerificationFacet} from "lifi/Facets/CalldataVerificationFacet.sol"; import {GenericSwapFacetV3} from "lifi/Facets/GenericSwapFacetV3.sol"; import {InvalidCallData} from "lifi/Errors/GenericErrors.sol"; import "forge-std/Test.sol"; contract CalldataVerificationFacetTest is Test { CalldataVerificationFacet internal calldataVerificationFacet; function setUp() public { calldataVerificationFacet = new CalldataVerificationFacet(); } function test_DemonstratesIncorrectRejectionAt484ByteBoundary() public { // Base calldata: selector only (4 bytes) bytes memory baseCalldata = abi.encodeWithSelector( GenericSwapFacetV3.swapTokensSingleV3ERC20ToERC20.selector ); // Pad to exactly 484 bytes with dummy data bytes memory callData484 = bytes.concat( baseCalldata, new bytes(480) // 480 + 4 = 484 bytes ); // Verify length assertEq(callData484.length, 484, "Calldata should be exactly 484 bytes"); // Test 484 bytes - expect revert due to bug (data.length <= 484) try calldataVerificationFacet.extractGenericSwapParameters(callData484) returns ( address, uint256, address, address, uint256 ) { fail("Expected revert for 484-byte calldata, but it succeeded"); } catch (bytes memory reason) { assertEq( reason, abi.encodeWithSelector(InvalidCallData.selector), "Revert reason should be InvalidCallData for 484 bytes" ); } } } ``` * Run Command: forge test --mt test_DemonstratesIncorrectRejectionAt484ByteBoundary -vvv ## Recommendation Update the length check to use < 484 instead of <= 484, ensuring 484 bytes—the documented minimum—is accepted ``` function extractGenericSwapParameters(bytes calldata data) public pure returns ( address sendingAssetId, uint256 amount, address receiver, address receivingAssetId, uint256 receivingAmount ) { if (data.length < 484) { // Fixed: changed <= to < revert InvalidCallData(); } // ... rest of the function } ```

kelvinsmart

Top competitions