Zellic - Audit Reports

Table handle overflow leads to abort

Note that it is feasible for the table_len to overflow if enough table iterators are created over many transactions, leading to an abort.

!let table_len = table_data.new_tables.len() as u32; // cast usize to u32 to ensure same length
Digest::update(&mut digest, UID_PREFIX);
Digest::update(&mut digest, table_context.session_id);
Digest::update(&mut digest, table_len.to_be_bytes());
let bytes = digest.finalize().to_vec();
let handle = AccountAddress::from_bytes(&bytes[0..AccountAddress::LENGTH])
    .map_err(|_| partial_extension_error("Unable to create table handle"))?;
let key_type = context.type_to_type_tag(&ty_args[0])?;
let value_type = context.type_to_type_tag(&ty_args[1])?;
!assert!(table_data
!    .new_tables
!    .insert(TableHandle(handle), TableInfo::new(key_type, value_type))
!    .is_none());

However, this has no security impact as the abort would be handled properly and simply revert the transaction.