Skip to content

Commit faed602

Browse files
committed
fix: split tests and add better checks for 2 tests
1 parent e6c44b3 commit faed602

File tree

1 file changed

+44
-31
lines changed

1 file changed

+44
-31
lines changed

test/Account.t.sol

Lines changed: 44 additions & 31 deletions
Original file line numberDiff line numberDiff line change
@@ -421,6 +421,8 @@ contract AccountTest is BaseTest {
421421
*
422422
*/
423423

424+
//////// Corrupting the 13 static fields of Intent ////////
425+
424426
// Test 1: eoa corruption
425427
function testPayWithAllCorruptedEOAFieldOfIntent() public {
426428
bytes memory maliciousCalldata = _createIntentOnMainnet();
@@ -550,64 +552,75 @@ contract AccountTest is BaseTest {
550552
);
551553
}
552554

553-
function testPayWithFiveCorruptedFieldOffsetsOfIntent() public {
554-
bool success;
555-
bytes memory returnData;
555+
//////// Corrupting the main offset and 7 dynamic field offsets of Intent ////////
556556

557-
// Test 1: Main Intent struct offset corruption
557+
// Test 1: Main Intent struct offset corruption
558+
function testPayWithCorruptedMainIntentStructOffsetOfIntent() public {
558559
bytes memory maliciousCalldata = _createIntentOnMainnet();
559-
uint256 len;
560560
assembly {
561-
mstore(add(maliciousCalldata, 32), 0x10000000000000000) // 2^64 (strictly greater than 2^64-1)
561+
// 0x10000000000000000 = 2^64 (strictly greater than 2^64-1, which is the max value
562+
// checked against, by the compiler in abi.decode())
563+
mstore(add(maliciousCalldata, 32), 0x10000000000000000)
562564
}
563-
(success, returnData) =
565+
(bool success, bytes memory returnData) =
564566
address(oc).call(abi.encodeWithSignature("execute(bytes)", maliciousCalldata));
565567
assertEq(success, false);
568+
}
566569

567-
// Test 2: executionData offset corruption
568-
maliciousCalldata = _createIntentOnMainnet();
570+
// Test 2: executionData offset corruption
571+
function testPayWithCorruptedExecutionDataOffsetOfIntent() public {
572+
bytes memory maliciousCalldata = _createIntentOnMainnet();
569573
assembly {
570-
mstore(add(maliciousCalldata, 96), 0x10000000000000001) // 2^64 + 1
574+
// note: this reverts with decoding error on corrupting with a random offset part of Intent
575+
mstore(add(maliciousCalldata, 96), 0x300)
571576
}
572-
(success, returnData) =
573-
address(oc).call(abi.encodeWithSignature("execute(bytes)", maliciousCalldata));
574-
assertEq(success, false);
577+
assertEq(oc.execute(maliciousCalldata), bytes4(keccak256("DecodingError()")));
578+
}
575579

576-
// Test 3: encodedPreCalls offset corruption
577-
maliciousCalldata = _createIntentOnMainnet();
580+
// Test 3: encodedPreCalls offset corruption
581+
function testPayWithCorruptedEncodedPreCallsOffsetOfIntent() public {
582+
bytes memory maliciousCalldata = _createIntentOnMainnet();
578583
assembly {
579-
mstore(add(maliciousCalldata, 288), 0x10000000000000002) // 2^64 + 2
584+
// note: this evm reverts with a value well within bounds of 2^64 - 1 too
585+
mstore(add(maliciousCalldata, 288), 0x300)
580586
}
581-
(success, returnData) =
587+
(bool success, bytes memory returnData) =
582588
address(oc).call(abi.encodeWithSignature("execute(bytes)", maliciousCalldata));
583589
assertEq(success, false);
590+
}
584591

585-
// Test 4: encodedFundTransfers offset corruption
586-
maliciousCalldata = _createIntentOnMainnet();
592+
// Test 4: encodedFundTransfers offset corruption
593+
function testPayWithCorruptedEncodedFundTransfersOffsetOfIntent() public {
594+
bytes memory maliciousCalldata = _createIntentOnMainnet();
587595
assembly {
588596
mstore(add(maliciousCalldata, 320), 0x10000000000000003) // 2^64 + 3
589597
}
590-
(success, returnData) =
598+
(bool success, bytes memory returnData) =
591599
address(oc).call(abi.encodeWithSignature("execute(bytes)", maliciousCalldata));
592600
assertEq(success, false);
601+
}
593602

594-
// Test 5: funderSignature offset corruption
595-
maliciousCalldata = _createIntentOnMainnet();
603+
// Test 5: funderSignature offset corruption
604+
function testPayWithCorruptedFunderSignatureOffsetOfIntent() public {
605+
bytes memory maliciousCalldata = _createIntentOnMainnet();
596606
assembly {
607+
// note: corrupting with 0xa20 returns 0x00000000, which is equivalent to not being corrupted
608+
// so we corrupt with extreme value
597609
mstore(add(maliciousCalldata, 480), 0x10000000000000004) // 2^64 + 4
598610
}
599-
(success, returnData) =
611+
(bool success, bytes memory returnData) =
600612
address(oc).call(abi.encodeWithSignature("execute(bytes)", maliciousCalldata));
601613
assertEq(success, false);
614+
}
602615

603-
// Test 6: signature offset corruption
604-
maliciousCalldata = _createIntentOnMainnet();
616+
// Test 6: signature offset corruption
617+
function testPayWithCorruptedSignatureOffsetOfIntent() public {
618+
bytes memory maliciousCalldata = _createIntentOnMainnet();
605619
assembly {
606-
mstore(add(maliciousCalldata, 608), 0x10000000000000005) // 2^64 + 5
620+
// note: this reverts with verification error on corrupting with a random offset part of Intent
621+
mstore(add(maliciousCalldata, 608), 0x300)
607622
}
608-
(success, returnData) =
609-
address(oc).call(abi.encodeWithSignature("execute(bytes)", maliciousCalldata));
610-
assertEq(success, false);
623+
assertEq(oc.execute(maliciousCalldata), bytes4(keccak256("VerificationError()")));
611624
}
612625

613626
// modified from testCrossChainKeyPreCallsAuthorization()'s intent creation
@@ -685,6 +698,7 @@ contract AccountTest is BaseTest {
685698
return abi.encode(u1);
686699
}
687700

701+
// Test 7: paymentSignature offset corruption
688702
// modified from Orchestrator.t.sol's testAccountPaymaster()
689703
function testPayWithCorruptedPaymentSignatureOffsetOfIntent() public {
690704
DelegatedEOA memory d = _randomEIP7702DelegatedEOA();
@@ -727,7 +741,6 @@ contract AccountTest is BaseTest {
727741
u.signature = _eoaSig(d.privateKey, digest);
728742
u.paymentSignature = _eoaSig(payer.privateKey, digest);
729743

730-
// Test 7: paymentSignature offset corruption
731744
bytes memory maliciousCalldata = abi.encode(u);
732745
assembly {
733746
mstore(add(maliciousCalldata, 640), 0x10000000000000006) // 2^64 + 6
@@ -775,6 +788,7 @@ contract AccountTest is BaseTest {
775788
uint256 snapshot;
776789
}
777790

791+
// Test 8: settlerContext offset corruption
778792
// modified from Orchestrator.t.sol's testMultiChainIntent()
779793
function testPayWithCorruptedSettlerContextOffsetOfIntent() public {
780794
_TestMultiChainIntentTemps memory t;
@@ -943,7 +957,6 @@ contract AccountTest is BaseTest {
943957
// Relay funds the user account, and the intended execution happens.
944958
t.encodedIntents[0] = abi.encode(t.outputIntent);
945959

946-
// Test 8: settlerContext offset corruption
947960
bytes memory maliciousCalldata = t.encodedIntents[0];
948961
assembly {
949962
mstore(add(maliciousCalldata, 512), 0x10000000000000007) // 2^64 + 7

0 commit comments

Comments
 (0)