SWC-124

Title

Write to Arbitrary Storage Location

Relationships

CWE-123: Write-what-where Condition

Description

A smart contract's data (e.g., storing the owner of the contract) is persistently stored at some storage location (i.e., a key or address) on the EVM level. The contract is responsible for ensuring that only authorized user or contract accounts may write to sensitive storage locations. If an attacker is able to write to arbitrary storage locations of a contract, the authorization checks may easily be circumvented. This can allow an attacker to corrupt the storage; for instance, by overwriting a field that stores the address of the contract owner.

Remediation

As a general advice, given that all data structures share the same storage (address) space, one should make sure that writes to one data structure cannot inadvertently overwrite entries of another data structure.

References

• Entry to Underhanded Solidity Coding Contest 2017 (honorable mention)

Contract Samples

arbitrary_location_write_simple.sol

pragma solidity ^0.4.25;

contract Wallet {
    uint[] private bonusCodes;
    address private owner;

    constructor() public {
        bonusCodes = new uint[](0);
        owner = msg.sender;
    }

    function () public payable {
    }

    function PushBonusCode(uint c) public {
        bonusCodes.push(c);
    }

    function PopBonusCode() public {
        require(0 <= bonusCodes.length);
        bonusCodes.length--;
    }

    function UpdateBonusCodeAt(uint idx, uint c) public {
        require(idx < bonusCodes.length);
        bonusCodes[idx] = c;
    }

    function Destroy() public {
        require(msg.sender == owner);
        selfdestruct(msg.sender);
    }
}

arbitrary_location_write_simple.yaml

description: Simple variant of write to arbitrary storage location
issues:
- id: SWC-124
  count: 1
  locations:
  - bytecode_offsets:
      '0x4d778370f4fe1789bc427ab08efc768fcb4c6c8b68d2ee41178340423445bd45': [294]
    line_numbers:
      arbitrary_location_write_simple.sol: [26]

arbitrary_location_write_simple_fixed.sol

pragma solidity ^0.4.25;

contract Wallet {
    uint[] private bonusCodes;
    address private owner;

    constructor() public {
        bonusCodes = new uint[](0);
        owner = msg.sender;
    }

    function () public payable {
    }

    function PushBonusCode(uint c) public {
        bonusCodes.push(c);
    }

    function PopBonusCode() public {
        require(0 < bonusCodes.length);
        bonusCodes.length--;
    }

    function UpdateBonusCodeAt(uint idx, uint c) public {
        require(idx < bonusCodes.length); //Since you now have to push very codes this is no longer an arbitray write.
        bonusCodes[idx] = c;
    }

    function Destroy() public {
        require(msg.sender == owner);
        selfdestruct(msg.sender);
    }
}

arbitrary_location_write_simple_fixed.yaml

description: Simple variant of write to arbitrary storage location
issues:
- id: SWC-124
  count: 0
  locations: []

mapping_write.sol

pragma solidity ^0.4.24;

//This code is derived from the Capture the Ether https://capturetheether.com/challenges/math/mapping/

contract Map {
    address public owner;
    uint256[] map;

    function set(uint256 key, uint256 value) public {
        if (map.length <= key) {
            map.length = key + 1;
        }

        map[key] = value;
    }

    function get(uint256 key) public view returns (uint256) {
        return map[key];
    }
    function withdraw() public{
      require(msg.sender == owner);
      msg.sender.transfer(address(this).balance);
    }
}

mapping_write.yaml

description: Write to arbitrary storage location using dynamic arrays
issues:
- id: SWC-124
  count: 1
  locations:
  - bytecode_offsets:
      '0xb3f8b66f8449fff6ee9ba17ae5534dfb2d8f4c4281c8a9ad56c1354a55c389d3': [395]
    line_numbers:
      mapping_write.sol: [14]