Submitted by K42
The readMem() and writeMem() functions do not properly validate the memory address being accessed. This could lead to unauthorized access to memory outside the intended ranges, which could then allow a black hat to read or modify sensitive data, in creative ways. As the contract is using a 32-bit address space uint32 for addresses without implementing proper bounds checking, possibly then allowing access to the entire 4GB address space.
Specific attack vectors:
The bug leading to the attack vectors mentioned, is present in both readMem() and writeMem() functions but here is the relevant snippet of readMem():
The function only checks for 4-byte alignment but does not validate if the address is within the allowed memory range.
Add the below foundry test function to MIPS.t.sol to show the bug, will need to fix setup when running if bugs occur:
I did this PoC to:
VsCode, Foundry, AuditWizard
Context
mbaxter (Optimism) disputed and commented:
obront (judge) commented:
