Zellic - Audit Reports

Assessment reports Public findings

Back to Zellic siteBack

Assessment reports>Initia>Low findings>Hex decode accepting invalid characters

GeneralOverview

Findings

Low (12)Ability to bypass swap fees Module can be duplicated in module publish requests Hex decode accepting invalid characters Stablepools can be created with one or no assets Bad decimal-parsing function accepts multiple dots Potential out-of-gas reversion when checking object permissions Incorrect string-formatting helper Incorrect minimum-TVL module-parameter check Move coin transfer can bypass blocked accounts Error not checked when fetching starting info Move coins are case-insensitive in cosmos Incorrect signer check for shorthand accounts

Informational (5)

DiscussionGeneral Discussion Improve AMM tests Bridge executor minting power Charge before using values Empty allowed_publishers array allows every address to publish ERC20Keeper with custom contracts Suggestions for additional security checks Table handle overflow leads to abort

Threat ModelWhat are threat models?stdlib

Audit ResultsSummary

AppendixProof of concept: Reference safety verifier bypass

Category: Coding Mistakes

Hex decode accepting invalid characters

Low Impact

Low Severity

Low Likelihood

Description

The hex.move module provides helper functions that can be used to convert a bytes array to and from a hexadecimal representation.

The decode_string accepts characters that are not valid hexadecimals and decodes characters that are not in the range 0-9a-f. This causes the strings 1f and 0g to be decoded to the value 0x1f.

Impact

This issue is reported as low impact since we could not identify an exploitation path using only the in-scope code. However, the impact could be higher for third-party modules.

Recommendations

Validate the input to ensure it contains only valid hexadecimal characters.

Remediation

Zellic © 2025Back to top ↑