fix(contracts): OZ-L04 Trie Depth Is Not Explicitly Capped (#1137)

Vineetkg20 · Mar 5, 2024 · 1495645 · 1495645
1 parent 8a4645e
commit 1495645
Show file tree

Hide file tree

Showing 2 changed files with 23 additions and 0 deletions.
diff --git a/integration-test/ZkTrieVerifier.spec.ts b/integration-test/ZkTrieVerifier.spec.ts
@@ -308,6 +308,28 @@ describe("ZkTrieVerifier", async () => {
     });
   }
 
+  it("should revert, when InvalidNodeDepth", async () => {
+    const test = testcases[0];
+    {
+      const proof = concat([
+        `0xfa`,
+        ...test.accountProof,
+        `0x${test.storageProof.length.toString(16).padStart(2, "0")}`,
+        ...test.storageProof,
+      ]);
+      await expect(verifier.verifyZkTrieProof(test.account, test.storage, proof)).to.revertedWith("InvalidNodeDepth");
+    }
+    {
+      const proof = concat([
+        `0x${test.accountProof.length.toString(16).padStart(2, "0")}`,
+        ...test.accountProof,
+        `0xfa`,
+        ...test.storageProof,
+      ]);
+      await expect(verifier.verifyZkTrieProof(test.account, test.storage, proof)).to.revertedWith("InvalidNodeDepth");
+    }
+  });
+
   it("should revert, when InvalidBranchNodeType", async () => {
     const test = testcases[0];
     for (const i of [0, 1, test.accountProof.length - 3]) {

diff --git a/src/libraries/verifier/ZkTrieVerifier.sol b/src/libraries/verifier/ZkTrieVerifier.sol
@@ -89,6 +89,7 @@ library ZkTrieVerifier {
 
                 // the first byte is the number of nodes + 1
                 let nodes := sub(byte(0, calldataload(ptr)), 1)
+                require(lt(nodes, 249), "InvalidNodeDepth")
                 ptr := add(ptr, 1)
 
                 // treat the leaf node with different logic