Vulnerability	Vulnerable Version
M Integer Overflow or Wraparound @ensdomains/ens-contracts is an ENS contracts Affected versions of this package are vulnerable to Integer Overflow or Wraparound. According to the documentation, controllers are allowed to register new domains and extend the expiry of existing domains, but they cannot change the ownership or reduce the expiration time of existing domains. However, a preliminary analysis suggests that an attacker-controlled controller may be able to reduce the expiration time of existing domains due to an integer overflow in the renew function. The vulnerable line of code is: `require( expiries[id] + duration + GRACE_PERIOD > duration + GRACE_PERIOD ); // Prevent future overflow` How to fix Integer Overflow or Wraparound? Upgrade `@ensdomains/ens-contracts` to version 0.0.22 or higher.	<0.0.22

Integer Overflow or Wraparound

@ensdomains/ens-contracts is an ENS contracts

Affected versions of this package are vulnerable to Integer Overflow or Wraparound. According to the documentation, controllers are allowed to register new domains and extend the expiry of existing domains, but they cannot change the ownership or reduce the expiration time of existing domains. However, a preliminary analysis suggests that an attacker-controlled controller may be able to reduce the expiration time of existing domains due to an integer overflow in the renew function.

The vulnerable line of code is:

require(
            expiries[id] + duration + GRACE_PERIOD > duration + GRACE_PERIOD
        ); // Prevent future overflow

How to fix Integer Overflow or Wraparound?

Upgrade @ensdomains/ens-contracts to version 0.0.22 or higher.

<0.0.22

Go back to all versions of this package