Homepage
About Snyk

@ensdomains/ens-contracts@0.0.18 vulnerabilities

ENS contracts

Go back to all versions of this package
Report a new vulnerability Found a mistake?

Direct Vulnerabilities

Known vulnerabilities in the @ensdomains/ens-contracts package. This does not include vulnerabilities belonging to this package’s dependencies.

Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.
Fix for free
Vulnerability Vulnerable Version
  • M
Integer Overflow or Wraparound

@ensdomains/ens-contracts is an ENS contracts

Affected versions of this package are vulnerable to Integer Overflow or Wraparound. According to the documentation, controllers are allowed to register new domains and extend the expiry of existing domains, but they cannot change the ownership or reduce the expiration time of existing domains. However, a preliminary analysis suggests that an attacker-controlled controller may be able to reduce the expiration time of existing domains due to an integer overflow in the renew function.

The vulnerable line of code is:

require(
            expiries[id] + duration + GRACE_PERIOD > duration + GRACE_PERIOD
        ); // Prevent future overflow

How to fix Integer Overflow or Wraparound?

Upgrade @ensdomains/ens-contracts to version 0.0.22 or higher.

<0.0.22
Go back to all versions of this package