Submitted by alexfilippov314, also found by RadiantLabs and OMEN
https://github.com/code-423n4/2024-07-optimism/blob/70556044e5e080930f686c4e5acde420104bb2c4/packages/contracts-bedrock/src/cannon/MIPS.sol#L921https://github.com/code-423n4/2024-07-optimism/blob/70556044e5e080930f686c4e5acde420104bb2c4/packages/contracts-bedrock/src/cannon/MIPS.sol#L929
According to the specification, ADD (page A-28), ADDI (page A-29), and SUB (page A-144) instructions should raise an Integer Overflow exception if overflow occurs. The current implementation simply wraps the result in such cases and does not raise any exceptions.
This inconsistency leads to a situation where MIPS contract cant correctly emulate such cases and therefore allows malicious actors to successfully forge invalid claims and challenge valid claims.
An inconsistent implementation of big-endian 32-bit MIPS32 architecture in the MIPS contract allows malicious actors to successfully forge invalid claims and challenge valid claims.
Consider raising Integer Overflow exception for ADD, ADDI, and SUB instructions if overflow occurs.
Math
clabby (Optimism) confirmed and commented:
KupiaSec (warden) commented:
rileyholterhus (warden) commented:
obront (judge) decreased severity to Medium and commented:
