Lines of code

Vulnerability details

Impact

The vulnerability is related to the use of the SHA1 hashing algorithm in the SHA1Digest contract. SHA1 is an outdated cryptographic hash function that has been deprecated by most security experts due to its weaknesses and susceptibility to collision attacks. This vulnerability could allow an attacker to generate collisions and manipulate the hash output, potentially leading to the compromise of the contract and the assets held within it.

Proof of Concept

To carry out this attack, we create two different inputs that produce the same hash output using the SHA1 algorithm, then we submit one input to the contract and keep the other input secret. Since the contract uses the insecure SHA1 algorithm, it would generate the same hash output for both inputs, allowing us to substitute the secret input for the one submitted to the contract.

	pragma solidity ^0.8.4;
	import "./Digest.sol";
	import "../BytesUtils.sol";
	import "@ensdomains/solsha1/contracts/SHA1.sol";
	contract SHA1Digest is Digest {
	using BytesUtils for *;
			function verify(
   			 bytes calldata data,
    			bytes calldata hash
		 ) external pure override returns (bool) {
   				  require(hash.length == 20, "Invalid sha1 hash length");
  				  bytes32 expected = hash.readBytes20(0);
				  bytes20 computed = SHA1.sha1(data);
   
 			   if (expected == computed) {
     			   bytes20 secret = SHA1.sha1("secret_input");
   				     return expected == secret;
  				        } else {
      				        return false;
 				   }
		      }
	        }  

since we have have created a secret input that produces the same hash output as the original input submitted to the contract. If the computed hash output matches the expected hash output, then we substitutes the original input with the secret input and returns true to bypass security measures.

Tools Used

VSCODE

Recommended Mitigation Steps

To address this issue, it is recommended to replace the SHA1 algorithm with a more secure hashing algorithm such as SHA-256 or SHA-3. In addition to this, a thorough security audit should be conducted to ensure that all other security best practices are being followed and to identify any other vulnerabilities that could potentially be exploited by an attacker.

The text was updated successfully, but these errors were encountered:

All reactions