Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Silent failure while validating multi-component parameters #158

Open
eternauta1337 opened this issue Sep 5, 2019 · 2 comments
Open

Silent failure while validating multi-component parameters #158

eternauta1337 opened this issue Sep 5, 2019 · 2 comments

Comments

@eternauta1337
Copy link
Contributor

eternauta1337 commented Sep 5, 2019

There might be a problem when checking for multi-component parameters such as votingSettings in templates like company: https://github.com/aragon/dao-templates/blob/master/templates/company/contracts/CompanyTemplate.sol#L197

I believe that Web3 is always setting the length to 3 and filling it with zeroes, or something like that. To demonstrate, I set up an example, in which the last 2 tests fail: https://github.com/ajsantander/arraylen/blob/master/test/arraylen.test.js#L15

@izqui
Copy link
Contributor

izqui commented Sep 5, 2019

A fixed-sized array (type[n]) always has length = n, so that check isn't doing anything and could be removed (or we could instead check that the values are not 0 if that's not allowed).

Fixed-sized arrays are ABI encoded differently than arbitrarily sized ones, as they are encoded inline and without the need to specify the length (because it's always n, and therefore the amount of bytes that the array takes when encoded can only depend on n which is known at compile time).

My guess is that this particular version of web3 just fills the calldata with 0s if one of the values is missing.

@eternauta1337
Copy link
Contributor Author

So, we have proof, and an explanation of why the current check doesn't work. I'd go with verifying each component individually then.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants