Repository navigation
Conversation
Attack: Attacker bypassed CanTransfer/Transfer balance checks by passing a uint64 value > max(int64) via protobuf varint encoding. The int64 conversion overflowed to negative, making balance checks always pass and Transfer silently fail, while the EVM contract still received the full uint64 value as msg.value. Fixes (defense in depth, from bottom to top): - statedb.go: add MaxInt64 overflow check in CanTransfer/Transfer before converting uint64→int64; also check Transfer result in SubBalance/AddBalance - evm.go: check Transfer() return value in Call() and Create(), revert snapshot on failure instead of silently continuing - exec.go: check Transfer() return value in transfer-only path - token.go: add IsInt64() guard in precompile transfer to prevent uint256 calldata→int64 overflow bypass - rpc.go: validate Amount > 0 at RPC entry in CreateCallTx, CreateDeployTx, CreateTransferOnlyTx to block protobuf varint bypass - statedb_test.go: add regression tests for overflow protection Co-Authored-By: Claude <[email protected]>
Add TestAttackSimulationFullFlow that verifies the overflow fix works in a realistic context with actual CoinsAccount + StateDB. Tests: - CanTransfer rejects the exact attack value (18446739873709551616 ≈ 2^64) - Transfer rejects the exact attack value (verified via error log) - MaxInt64 is not falsely rejected by the overflow guard Co-Authored-By: Claude <[email protected]>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
修复 EVM 层 uint64→int64 整数溢出漏洞，阻止攻击者绕过余额检查零成本铸造 WBTY。
Attack
攻击者通过 protobuf varint 编码在 RPC 入口绕过 EvmContractCallReq.Amount (int64) 的限制，传入接近 2^64 的值。该值在 MemoryStateDB.CanTransfer/Transfer 中被转换为 int64 时溢出为负数，导致：
结果：攻击者零成本铸造 ~1844 亿 WBTY，随后 withdraw 兑走真 BTY。
Fix (防御纵深，6 个文件)
🤖 Generated with Claude Code
Co-Authored-By: Claude [email protected]