SWC-124
Title
Write to Arbitrary Storage Location
Relationships
CWE-123: Write-what-where Condition
Description
A smart contract's data (e.g., storing the owner of the contract) is persistently stored at some storage location (i.e., a key or address) on the EVM level. The contract is responsible for ensuring that only authorized user or contract accounts may write to sensitive storage locations. If an attacker is able to write to arbitrary storage locations of a contract, the authorization checks may easily be circumvented. This can allow an attacker to corrupt the storage; for instance, by overwriting a field that stores the address of the contract owner.
Remediation
As a general advice, given that all data structures share the same storage (address) space, one should make sure that writes to one data structure cannot inadvertently overwrite entries of another data structure.
References
Contract Samples
arbitrary_location_write_simple.sol
pragma solidity ^0.4.25;
contract Wallet {
uint[] private bonusCodes;
address private owner;
constructor() public {
bonusCodes = new uint[](0);
owner = msg.sender;
}
function () public payable {
}
function PushBonusCode(uint c) public {
bonusCodes.push(c);
}
function PopBonusCode() public {
require(0 <= bonusCodes.length);
bonusCodes.length--;
}
function UpdateBonusCodeAt(uint idx, uint c) public {
require(idx < bonusCodes.length);
bonusCodes[idx] = c;
}
function Destroy() public {
require(msg.sender == owner);
selfdestruct(msg.sender);
}
}
arbitrary_location_write_simple.yaml
description: Simple variant of write to arbitrary storage location
issues:
- id: SWC-124
count: 1
locations:
- bytecode_offsets:
'0x4d778370f4fe1789bc427ab08efc768fcb4c6c8b68d2ee41178340423445bd45': [294]
line_numbers:
arbitrary_location_write_simple.sol: [26]
arbitrary_location_write_simple_fixed.sol
pragma solidity ^0.4.25;
contract Wallet {
uint[] private bonusCodes;
address private owner;
constructor() public {
bonusCodes = new uint[](0);
owner = msg.sender;
}
function () public payable {
}
function PushBonusCode(uint c) public {
bonusCodes.push(c);
}
function PopBonusCode() public {
require(0 < bonusCodes.length);
bonusCodes.length--;
}
function UpdateBonusCodeAt(uint idx, uint c) public {
require(idx < bonusCodes.length); //Since you now have to push very codes this is no longer an arbitray write.
bonusCodes[idx] = c;
}
function Destroy() public {
require(msg.sender == owner);
selfdestruct(msg.sender);
}
}
arbitrary_location_write_simple_fixed.yaml
description: Simple variant of write to arbitrary storage location
issues:
- id: SWC-124
count: 0
locations: []
mapping_write.sol
pragma solidity ^0.4.24;
//This code is derived from the Capture the Ether https://capturetheether.com/challenges/math/mapping/
contract Map {
address public owner;
uint256[] map;
function set(uint256 key, uint256 value) public {
if (map.length <= key) {
map.length = key + 1;
}
map[key] = value;
}
function get(uint256 key) public view returns (uint256) {
return map[key];
}
function withdraw() public{
require(msg.sender == owner);
msg.sender.transfer(address(this).balance);
}
}
mapping_write.yaml
description: Write to arbitrary storage location using dynamic arrays
issues:
- id: SWC-124
count: 1
locations:
- bytecode_offsets:
'0xb3f8b66f8449fff6ee9ba17ae5534dfb2d8f4c4281c8a9ad56c1354a55c389d3': [395]
line_numbers:
mapping_write.sol: [14]