Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

merge optimism-v1.9.3 into develop #10

Merged
merged 265 commits into from
Nov 28, 2024

merge optimism-v1.9.3 into develop

985994d
Select commit
Loading
Failed to load commit list.
Merged

merge optimism-v1.9.3 into develop #10

merge optimism-v1.9.3 into develop
985994d
Select commit
Loading
Failed to load commit list.
GitHub Advanced Security / Slither failed Nov 22, 2024 in 6s

46 new alerts including 17 high severity security vulnerabilities

New alerts in code changed by this pull request

Security Alerts:

  • 17 high
  • 29 medium

Alerts not introduced by this pull request might have been detected because the code changes were too large.

See annotations below for details.

View all branch alerts.

Annotations

Check warning on line 358 in packages/contracts-bedrock/src/L1/DataAvailabilityChallenge.sol

See this annotation in the file changed.

Code scanning / Slither

Uninitialized local variables Medium

DataAvailabilityChallenge.resolve(uint256,bytes,bytes).computedCommitment is a local variable never initialized

Check failure on line 69 in packages/contracts-bedrock/src/L1/DelayedVetoable.sol

See this annotation in the file changed.

Code scanning / Slither

Incorrect return in assembly High

DelayedVetoable.readOrHandle() calls DelayedVetoable._handleCall() which halt the execution return(uint256,uint256)(returndata + 0x20,mload(uint256)(returndata))

Check failure on line 93 in packages/contracts-bedrock/src/L1/DelayedVetoable.sol

See this annotation in the file changed.

Code scanning / Slither

Incorrect return in assembly High

DelayedVetoable.initiator() calls DelayedVetoable.readOrHandle() which halt the execution return(uint256,uint256)(returndata + 0x20,mload(uint256)(returndata))

Check failure on line 99 in packages/contracts-bedrock/src/L1/DelayedVetoable.sol

See this annotation in the file changed.

Code scanning / Slither

Incorrect return in assembly High

DelayedVetoable.vetoer() calls DelayedVetoable.readOrHandle() which halt the execution return(uint256,uint256)(returndata + 0x20,mload(uint256)(returndata))

Check failure on line 105 in packages/contracts-bedrock/src/L1/DelayedVetoable.sol

See this annotation in the file changed.

Code scanning / Slither

Incorrect return in assembly High

DelayedVetoable.target() calls DelayedVetoable.readOrHandle() which halt the execution return(uint256,uint256)(returndata + 0x20,mload(uint256)(returndata))

Check failure on line 111 in packages/contracts-bedrock/src/L1/DelayedVetoable.sol

See this annotation in the file changed.

Code scanning / Slither

Incorrect return in assembly High

DelayedVetoable.delay() calls DelayedVetoable.readOrHandle() which halt the execution return(uint256,uint256)(returndata + 0x20,mload(uint256)(returndata))

Check failure on line 118 in packages/contracts-bedrock/src/L1/DelayedVetoable.sol

See this annotation in the file changed.

Code scanning / Slither

Incorrect return in assembly High

DelayedVetoable.queuedAt(bytes32) calls DelayedVetoable.readOrHandle() which halt the execution return(uint256,uint256)(returndata + 0x20,mload(uint256)(returndata))

Check failure on line 176 in packages/contracts-bedrock/src/L1/DelayedVetoable.sol

See this annotation in the file changed.

Code scanning / Slither

Incorrect return in assembly High

DelayedVetoable._handleCall() calls DelayedVetoable._forwardAndHalt(bytes32) which halt the execution return(uint256,uint256)(returndata + 0x20,mload(uint256)(returndata))

Check warning on line 176 in packages/contracts-bedrock/src/L1/DelayedVetoable.sol

See this annotation in the file changed.

Code scanning / Slither

Reentrancy vulnerabilities Medium

Reentrancy in DelayedVetoable._handleCall():
External calls:
- _forwardAndHalt(callHash)
- (success,returndata) = TARGET.call(msg.data)
State variables written after the call(s):
- _queuedAt[callHash] = block.timestamp
DelayedVetoable._queuedAt can be used in cross function reentrancies:
- DelayedVetoable._handleCall()
- DelayedVetoable.queuedAt(bytes32)

Check warning on line 321 in packages/contracts-bedrock/src/L1/L2OutputOracle.sol

See this annotation in the file changed.

Code scanning / Slither

Contracts that lock Ether Medium

Contract locking ether found:
Contract L2OutputOracle has payable functions:
- L2OutputOracle.proposeL2Output(bytes32,uint256,bytes32,uint256)
But does not have a function to withdraw the ether

Check warning on line 225 in packages/contracts-bedrock/src/L1/OPContractsManager.sol

See this annotation in the file changed.

Code scanning / Slither

Uninitialized local variables Medium

OPContractsManager.deploy(OPContractsManager.DeployInput).output is a local variable never initialized

Check warning on line 444 in packages/contracts-bedrock/src/L1/OptimismPortal.sol

See this annotation in the file changed.

Check warning on line 444 in packages/contracts-bedrock/src/L1/OptimismPortal.sol

See this annotation in the file changed.

Code scanning / Slither

Dangerous usage of `tx.origin` Medium

OptimismPortal.finalizeWithdrawalTransaction(Types.WithdrawalTransaction) uses tx.origin for authorization: success == false && tx.origin == Constants.ESTIMATION_ADDRESS

Check warning on line 365 in packages/contracts-bedrock/src/L1/OptimismPortal2.sol

See this annotation in the file changed.

Check warning on line 458 in packages/contracts-bedrock/src/L1/OptimismPortal2.sol

See this annotation in the file changed.

Check warning on line 458 in packages/contracts-bedrock/src/L1/OptimismPortal2.sol

See this annotation in the file changed.

Check warning on line 151 in packages/contracts-bedrock/src/L1/ResourceMetering.sol

See this annotation in the file changed.

Check warning on line 221 in packages/contracts-bedrock/src/L1/SystemConfig.sol

See this annotation in the file changed.

Check warning on line 590 in packages/contracts-bedrock/src/cannon/MIPS2.sol

See this annotation in the file changed.

Code scanning / Slither

Divide before multiply Medium

MIPS2.handleSyscall(bytes32) performs a multiplication on the result of a division:
- nsecs = uint32((state.step % MIPSSyscalls.HZ) * (1_000_000_000 / MIPSSyscalls.HZ))

Check warning on line 654 in packages/contracts-bedrock/src/cannon/PreimageOracle.sol

See this annotation in the file changed.

Code scanning / Slither

Uninitialized local variables Medium

PreimageOracle.challengeFirstLPP(address,uint256,PreimageOracle.Leaf,bytes32[]).stateMatrix is a local variable never initialized

Check failure on line 120 in packages/contracts-bedrock/src/cannon/libraries/MIPSMemory.sol

See this annotation in the file changed.

Check failure on line 277 in packages/contracts-bedrock/src/cannon/libraries/MIPSSyscalls.sol

See this annotation in the file changed.

Code scanning / Slither

Incorrect shift in assembly. High

MIPSSyscalls.handleSysRead(MIPSSyscalls.SysReadParams) contains an incorrect shift operation: suffixMask_handleSysRead_asm_0 = 1 << 4 - alignment_handleSysRead_asm_0 - datLen * 8 - 1

Check failure on line 277 in packages/contracts-bedrock/src/cannon/libraries/MIPSSyscalls.sol

See this annotation in the file changed.

Code scanning / Slither

Incorrect shift in assembly. High

MIPSSyscalls.handleSysRead(MIPSSyscalls.SysReadParams) contains an incorrect shift operation: mask_handleSysRead_asm_0 = 1 << 4 - alignment_handleSysRead_asm_0 * 8 - 1

Check failure on line 344 in packages/contracts-bedrock/src/cannon/libraries/MIPSSyscalls.sol

See this annotation in the file changed.

Code scanning / Slither

Incorrect shift in assembly. High

MIPSSyscalls.handleSysWrite(uint32,uint32,uint32,bytes32,uint32,uint256,bytes32) contains an incorrect shift operation: mask_handleSysWrite_asm_0 = 1 << _a2 * 8 - 1

Check warning on line 109 in packages/contracts-bedrock/src/dispute/DisputeGameFactory.sol

See this annotation in the file changed.

Code scanning / Slither

Unused return Medium

DisputeGameFactory.games(GameType,Claim,bytes) ignores return value by (None,timestamp,proxy) = _disputeGames[uuid].unpack()