[5/n permissions] feat: add erc20 token limit plugin #72
Conversation
howydev
force-pushed
the
howy/add-usdc-token-limit-plugin
branch
from
04f7b56 to
a8b4b8b
Compare
howydev
force-pushed
the
howy/add-native-token-limit-plugin
branch
2 times, most recently
from
224b9d6 to
3da0f37
Compare
howydev
force-pushed
the
howy/add-usdc-token-limit-plugin
branch
from
a8b4b8b to
f8bc912
Compare
howydev
force-pushed
the
howy/add-native-token-limit-plugin
branch
from
3da0f37 to
9bb72f9
Compare
howydev
force-pushed
the
howy/add-usdc-token-limit-plugin
branch
from
f8bc912 to
b957137
Compare
howydev
force-pushed
the
howy/add-native-token-limit-plugin
branch
from
9bb72f9 to
df3870d
Compare
howydev
force-pushed
the
howy/add-usdc-token-limit-plugin
branch
from
b957137 to
32d5467
Compare
howydev
force-pushed
the
howy/add-native-token-limit-plugin
branch
from
df3870d to
f0f72e0
Compare
howydev
force-pushed
the
howy/add-usdc-token-limit-plugin
branch
from
32d5467 to
dcd5cd4
Compare
howydev
changed the title
| executeCalldata.offset := add(relativeOffset, 32) | ||
| executeCalldata.length := calldataload(relativeOffset) |
There was a problem hiding this comment.
I think this is vulnerable to manipulation because unlike abi.decode, this doesn't check the bounds of the offset or length - you could pass an offset that points to something invalid in the outer calldata, but points to something valid in inner calldata. E.g. the add(...) operations are unchecked, so you could use large numbers to effective subtract an offset, rather than add, and get varying behavior between the checking plugin and the actual receiving token contract.
Might be fine for now with some warnings, or we could just switch these to be abi.decode instead. As a sample, we don't have to worry too much about gas.
| if (spend > limit) { | ||
| revert ExceededNativeTokenLimit(); | ||
| } | ||
| limits[msg.sender][token][functionId] = limit - spend; |
There was a problem hiding this comment.
This linter warning is curious - I couldn't find an external function invoked before _checkAndDecrementLimit. Do you see any?
howydev
force-pushed
the
howy/add-native-token-limit-plugin
branch
from
f0f72e0 to
942de3c
Compare
howydev
force-pushed
the
howy/add-usdc-token-limit-plugin
branch
from
dcd5cd4 to
547b99a
Compare
No description provided.