@@ -421,6 +421,8 @@ contract AccountTest is BaseTest {
421421 *
422422 */
423423
424+ //////// Corrupting the 13 static fields of Intent ////////
425+
424426 // Test 1: eoa corruption
425427 function testPayWithAllCorruptedEOAFieldOfIntent () public {
426428 bytes memory maliciousCalldata = _createIntentOnMainnet ();
@@ -550,64 +552,75 @@ contract AccountTest is BaseTest {
550552 );
551553 }
552554
553- function testPayWithFiveCorruptedFieldOffsetsOfIntent () public {
554- bool success;
555- bytes memory returnData;
555+ //////// Corrupting the main offset and 7 dynamic field offsets of Intent ////////
556556
557- // Test 1: Main Intent struct offset corruption
557+ // Test 1: Main Intent struct offset corruption
558+ function testPayWithCorruptedMainIntentStructOffsetOfIntent () public {
558559 bytes memory maliciousCalldata = _createIntentOnMainnet ();
559- uint256 len;
560560 assembly {
561- mstore (add (maliciousCalldata, 32 ), 0x10000000000000000 ) // 2^64 (strictly greater than 2^64-1)
561+ // 0x10000000000000000 = 2^64 (strictly greater than 2^64-1, which is the max value
562+ // checked against, by the compiler in abi.decode())
563+ mstore (add (maliciousCalldata, 32 ), 0x10000000000000000 )
562564 }
563- (success, returnData) =
565+ (bool success , bytes memory returnData ) =
564566 address (oc).call (abi.encodeWithSignature ("execute(bytes) " , maliciousCalldata));
565567 assertEq (success, false );
568+ }
566569
567- // Test 2: executionData offset corruption
568- maliciousCalldata = _createIntentOnMainnet ();
570+ // Test 2: executionData offset corruption
571+ function testPayWithCorruptedExecutionDataOffsetOfIntent () public {
572+ bytes memory maliciousCalldata = _createIntentOnMainnet ();
569573 assembly {
570- mstore (add (maliciousCalldata, 96 ), 0x10000000000000001 ) // 2^64 + 1
574+ // note: this reverts with decoding error on corrupting with a random offset part of Intent
575+ mstore (add (maliciousCalldata, 96 ), 0x300 )
571576 }
572- (success, returnData) =
573- address (oc).call (abi.encodeWithSignature ("execute(bytes) " , maliciousCalldata));
574- assertEq (success, false );
577+ assertEq (oc.execute (maliciousCalldata), bytes4 (keccak256 ("DecodingError() " )));
578+ }
575579
576- // Test 3: encodedPreCalls offset corruption
577- maliciousCalldata = _createIntentOnMainnet ();
580+ // Test 3: encodedPreCalls offset corruption
581+ function testPayWithCorruptedEncodedPreCallsOffsetOfIntent () public {
582+ bytes memory maliciousCalldata = _createIntentOnMainnet ();
578583 assembly {
579- mstore (add (maliciousCalldata, 288 ), 0x10000000000000002 ) // 2^64 + 2
584+ // note: this evm reverts with a value well within bounds of 2^64 - 1 too
585+ mstore (add (maliciousCalldata, 288 ), 0x300 )
580586 }
581- (success, returnData) =
587+ (bool success , bytes memory returnData ) =
582588 address (oc).call (abi.encodeWithSignature ("execute(bytes) " , maliciousCalldata));
583589 assertEq (success, false );
590+ }
584591
585- // Test 4: encodedFundTransfers offset corruption
586- maliciousCalldata = _createIntentOnMainnet ();
592+ // Test 4: encodedFundTransfers offset corruption
593+ function testPayWithCorruptedEncodedFundTransfersOffsetOfIntent () public {
594+ bytes memory maliciousCalldata = _createIntentOnMainnet ();
587595 assembly {
588596 mstore (add (maliciousCalldata, 320 ), 0x10000000000000003 ) // 2^64 + 3
589597 }
590- (success, returnData) =
598+ (bool success , bytes memory returnData ) =
591599 address (oc).call (abi.encodeWithSignature ("execute(bytes) " , maliciousCalldata));
592600 assertEq (success, false );
601+ }
593602
594- // Test 5: funderSignature offset corruption
595- maliciousCalldata = _createIntentOnMainnet ();
603+ // Test 5: funderSignature offset corruption
604+ function testPayWithCorruptedFunderSignatureOffsetOfIntent () public {
605+ bytes memory maliciousCalldata = _createIntentOnMainnet ();
596606 assembly {
607+ // note: corrupting with 0xa20 returns 0x00000000, which is equivalent to not being corrupted
608+ // so we corrupt with extreme value
597609 mstore (add (maliciousCalldata, 480 ), 0x10000000000000004 ) // 2^64 + 4
598610 }
599- (success, returnData) =
611+ (bool success , bytes memory returnData ) =
600612 address (oc).call (abi.encodeWithSignature ("execute(bytes) " , maliciousCalldata));
601613 assertEq (success, false );
614+ }
602615
603- // Test 6: signature offset corruption
604- maliciousCalldata = _createIntentOnMainnet ();
616+ // Test 6: signature offset corruption
617+ function testPayWithCorruptedSignatureOffsetOfIntent () public {
618+ bytes memory maliciousCalldata = _createIntentOnMainnet ();
605619 assembly {
606- mstore (add (maliciousCalldata, 608 ), 0x10000000000000005 ) // 2^64 + 5
620+ // note: this reverts with verification error on corrupting with a random offset part of Intent
621+ mstore (add (maliciousCalldata, 608 ), 0x300 )
607622 }
608- (success, returnData) =
609- address (oc).call (abi.encodeWithSignature ("execute(bytes) " , maliciousCalldata));
610- assertEq (success, false );
623+ assertEq (oc.execute (maliciousCalldata), bytes4 (keccak256 ("VerificationError() " )));
611624 }
612625
613626 // modified from testCrossChainKeyPreCallsAuthorization()'s intent creation
@@ -685,6 +698,7 @@ contract AccountTest is BaseTest {
685698 return abi.encode (u1);
686699 }
687700
701+ // Test 7: paymentSignature offset corruption
688702 // modified from Orchestrator.t.sol's testAccountPaymaster()
689703 function testPayWithCorruptedPaymentSignatureOffsetOfIntent () public {
690704 DelegatedEOA memory d = _randomEIP7702DelegatedEOA ();
@@ -727,7 +741,6 @@ contract AccountTest is BaseTest {
727741 u.signature = _eoaSig (d.privateKey, digest);
728742 u.paymentSignature = _eoaSig (payer.privateKey, digest);
729743
730- // Test 7: paymentSignature offset corruption
731744 bytes memory maliciousCalldata = abi.encode (u);
732745 assembly {
733746 mstore (add (maliciousCalldata, 640 ), 0x10000000000000006 ) // 2^64 + 6
@@ -775,6 +788,7 @@ contract AccountTest is BaseTest {
775788 uint256 snapshot;
776789 }
777790
791+ // Test 8: settlerContext offset corruption
778792 // modified from Orchestrator.t.sol's testMultiChainIntent()
779793 function testPayWithCorruptedSettlerContextOffsetOfIntent () public {
780794 _TestMultiChainIntentTemps memory t;
@@ -943,7 +957,6 @@ contract AccountTest is BaseTest {
943957 // Relay funds the user account, and the intended execution happens.
944958 t.encodedIntents[0 ] = abi.encode (t.outputIntent);
945959
946- // Test 8: settlerContext offset corruption
947960 bytes memory maliciousCalldata = t.encodedIntents[0 ];
948961 assembly {
949962 mstore (add (maliciousCalldata, 512 ), 0x10000000000000007 ) // 2^64 + 7
0 commit comments