Report #31739

Report ID

#31739

Report type

Smart Contract

Has PoC?

Yes

Target

https://etherscan.io/address/0xC1E088fC1323b20BCBee9bd1B9fC9546db5624C5

Impacts

Unbounded gas consumption

Description

The Diamond contract contains potential unbound gas consumption issues, particularly in its fallback function and dynamic array operations. If these issues are exploited in production, they can lead to out-of-gas errors, making the contract unusable and causing transaction failures, which can disrupt contract functionality and result in financial losses.

Vulnerability Details

Fallback Function with Unbounded Delegatecall

The fallback function in the Diamond contract uses delegatecall to execute functions from various facets. The gas consumption of these delegatecall operations is unbounded, depending on the implementation of the called functions, which can lead to excessive gas usage.

Code:

Dynamic Array Operations

Functions like addFunctions, replaceFunctions, and removeFunctions operate on dynamic arrays, such as facetFunctionSelectors. If these arrays grow too large, the operations on them can consume unbounded gas.

Code:

Unbounded Loop in diamondCut

The diamondCut function iterates over the _diamondCut array, and the size of this array can lead to unbounded gas consumption.

Code:

Impact Details

Severity

The potential impact of these vulnerabilities includes:

• Transaction Failures: Unbounded gas consumption can cause transactions to run out of gas, leading to transaction failures.
• Contract Downtime: Continuous failures may render the contract unusable, affecting all its users.
• Financial Losses: Failed transactions can lead to financial losses due to gas fees and disrupted contract operations.

References

• [EIP-2535 Diamond Standard](https://eips.ethereum.org/EIPS/eip-2535)
• [Solidity Assembly Documentation](https://docs.soliditylang.org/en/v0.7.6/assembly.html)
• [Solidity Gas and Fees](https://docs.soliditylang.org/en/v0.7.6/introduction-to-smart-contracts.html#gas-and-fees)

Proof of concept

To demonstrate the unbounded gas consumption issue in the Diamond contract, we will create a proof-of-concept (PoC) scenario where a function call in the fallback function causes excessive gas usage. We will simulate this scenario by implementing a facet function that performs a gas-intensive operation, and then invoke it through the Diamond contract's fallback function.

Step-by-Step PoC

1. Deploy the Diamond Contract.
2. Deploy a Facet with a Gas-Intensive Function.
3. Add the Facet to the Diamond Contract.
4. Invoke the Gas-Intensive Function through the Diamond Contract.

Code Implementation

1. Diamond.sol

This is the Diamond contract provided initially:

2. GasIntensiveFacet.sol

This facet contains a gas-intensive function.

// SPDX-License-Identifier: MIT
pragma solidity ^0.7.6;

contract GasIntensiveFacet {
    function gasIntensiveOperation() external {
        uint sum = 0;
        for (uint i = 0; i < 100000; i++) {
            sum += i;
        }
    }
}

3. Deployment and Interaction Script

Use Hardhat or Truffle to deploy the contracts and interact with them.

Running the PoC

1. Setup Hardhat or Truffle: Ensure you have Hardhat or Truffle configured in your project.
2. Compile the Contracts: Compile the Diamond and GasIntensiveFacet contracts.
3. Deploy the Contracts: Run the deploy.js script to deploy the contracts and add the facet.
4. Invoke the Gas-Intensive Function: The script will invoke the gasIntensiveOperation function through the Diamond contract.

Conclusion

This PoC demonstrates how unbounded gas consumption can occur in the Diamond contract. The GasIntensiveFacet contains a function that performs a gas-intensive operation. When this function is added to the Diamond contract and invoked through the fallback function, it consumes a significant amount of gas, potentially leading to out-of-gas errors. This highlights the need for proper gas management and optimization in smart contract design.