NULL Pointer Dereference in handleMsgLockCoin() #8
Description
Describe The Bug
The lock of an unregistered coin leads to a null pointer dereference of the asset handler located at /x/asset/handler.go. Specifically, the handleMsgLockCoin() routine is designed to handle the MsgLockCoin message in order to lock a coin. However, the checks on the input message are not thorough. As a result, a malicious MsgLockCoin message can be crafted to contain an unregistered coin and its execution could lead to a null pointer dereference of the running processes. In the following, we show the related code snippet.
Code Snippets (Optional)
165 // handleMsgLockCoin Handle Msg lock coin
166 func handleMsgLockCoin(ctx chainTypes.Context, k keeper.AssetCoinsKeeper, msg *types.MsgLockCoin) (*sdk.Result, error) {
... ...
181 for _, c := range msgData.Amount {
182 creator, symbol, err := chainTypes.CoinAccountsFromDenom(c.Denom)
183 if err != nil {
184 return nil, sdkerrors.Wrapf(err, "get creator and symbol from coin %s", msg.Amount.String())
185 }
186
187 stat, err := k.GetCoinStat(ctx.Context(), creator, symbol)
188 if err != nil {
189 return nil, sdkerrors.Wrapf(err, "get coin stat from coin %s", msg.Amount.String())
190 }
191
192 if !stat.CanLock {
193 return nil, sdkerrors.Wrapf(types.ErrAssetCoinCannotBeLock, "coin %s cannot be locked", msg.Amount.String())
194 }
195 }Input/Output
- Craft a MsgLockCoin: '{"id": "kratos", "amount": "1kratos/kvs", "height": "111"}'
- Output: '{"panic": "runtime error: invalid memory address or nil pointer dereference"}'
To Reproduce
Steps to reproduce the behavior:
- sudo ./scripts/boot-testnet.sh
- sudo ./build/ktscli tx asset lock kratos 111 1kratos/kvs --keyring-backend test --chain-id testing --home /testing/cli/ --from kratos
Expected Behavior
Returns an error "coin stat is nil".
Screenshots
Desktop (please complete the following information):
- OS: [macOS High Sierra 10.13.6]
Additional Context (Optional)
None
Contact Information
Email - [email protected]