Improve xtokens precompile errors (#2620)

* Improve xtokens precompile errors * fix * revert dependencies
AcalaNetwork · Sep 27, 2023 · 99407b0 · 99407b0
1 parent 81cfc2d
commit 99407b0
Show file tree

Hide file tree

Showing 2 changed files with 30 additions and 0 deletions.
diff --git a/runtime/common/src/precompile/xtokens.rs b/runtime/common/src/precompile/xtokens.rs
@@ -34,6 +34,7 @@ use num_enum::{IntoPrimitive, TryFromPrimitive};
 use orml_traits::{XcmTransfer, XtokensWeightInfo};
 use orml_xtokens::XtokensWeight;
 use primitives::{Balance, CurrencyId};
+use sp_core::Get;
 use sp_runtime::{traits::Convert, RuntimeDebug};
 use sp_std::{marker::PhantomData, prelude::*};
 use xcm::{
@@ -320,6 +321,14 @@ where
 					.saturating_add(1);
 				let currencies_len = input.u32_at(currencies_index)? as usize;
 
+				if currencies_len > <Runtime as orml_xtokens::Config>::MaxAssetsForTransfer::get() {
+					return Err(PrecompileFailure::Revert {
+						exit_status: ExitRevert::Reverted,
+						output: "invalid currencies size".into(),
+						cost: target_gas_limit(target_gas).unwrap_or_default(),
+					});
+				}
+
 				let mut currencies = Vec::with_capacity(currencies_len);
 				for i in 0..currencies_len {
 					let index = currencies_index.saturating_add(i.saturating_mul(2)); // address + amount
@@ -553,6 +562,15 @@ where
 					.saturating_div(PER_PARAM_BYTES)
 					.saturating_add(1);
 				let currencies_len = input.u32_at(currencies_index)? as usize;
+
+				if currencies_len > <Runtime as orml_xtokens::Config>::MaxAssetsForTransfer::get() {
+					return Err(PrecompileFailure::Revert {
+						exit_status: ExitRevert::Reverted,
+						output: "invalid currencies size".into(),
+						cost: target_gas_limit(target_gas).unwrap_or_default(),
+					});
+				}
+
 				let mut currencies = Vec::with_capacity(currencies_len);
 				let mut read_currency: u64 = 0;
 

diff --git a/ts-tests/tests/test-precompiles.ts b/ts-tests/tests/test-precompiles.ts
@@ -60,4 +60,16 @@ describeWithAcala("Acala RPC (Precompile)", (context) => {
 		});
 		expect(callResult).to.equal(message);
 	});
+
+	it('Precompile call should not panic', async function () {
+		// currencies_len is MAX_UINT32
+		const input = '0xcfea5c46000000000000000000000000100000000000000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000a00000000000000000000000000000000000000000000000000000000000000001000000000000000000000000000000000000000000000000000000000000014000000000000000000000000000000000000000000000000000000000000001a000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000001000000000000000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000100000000000000000000000010000000000000000000000000000000000000010000000000000000000000000000000000000000000000000000000000000002000000000000000000000000000000000000000000000000000000000000002503000101000202020202020202020202020202020202020202020202020202020202020202000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000901821a0600020004000000000000000000000000000000000000000000000000';
+
+		await expect(context.provider.call({
+			to: '0x000000000000000000000000000000000000040b',
+			// Passes system contract filter
+			from: '0x0000000000000000000100000000000000000001',
+			data: input,
+		})).to.be.rejectedWith('VM Exception while processing transaction: execution revert: invalid currencies size');
+	});
 });