Submitted by izhuer
The fuse constraints can be violated by a malicious owner of the parent node (i.e., the hacker). There are two specific consequences the hacker can cause.
Basically, ENS NameWrapper uses the following rules to prevent all previous C4 hacks (note that I will assume the audience has some background regarding the ENS codebase).
However, such guarantees would only get effective when the CANNOT_UNWRAP fuse of the subject node is burnt.
Considering the following scenario.
At this stage, things went wrong.
Again, currently the sub3.sub2.sub1.eth is valid in NameWrapper w/ PARENT_CANNOT_CONTROL | CANNOT_UNWRAP | CANNOT_CREATE_SUBDOMAIN burnt, but the ENS registry owner of sub3.sub2.sub1.eth is the hacker.
The hacker can:
The poc_ens.js file (included in wardens original submission) demonstrates the above hack, via 6 different attack paths.
To validate the PoC, put the file in ./test/wrapper and run npx hardhat test test/wrapper/poc_ens.js
The NameWrapper.sol file (included in wardens original submission) demonstrates the patch.
In short, we try to guarantee only fuses of wrapped nodes can be burnt.
Alex the Entreprenerd (judge) commented:
jefflau (ENS) confirmed
Alex the Entreprenerd (judge) commented:
izhuer (warden) commented:
izhuer (warden) commented:
izhuer (warden) commented:
csanuragjain (warden) commented:
