From 04729c44b451bcf4818048621c890960bb7f8afb Mon Sep 17 00:00:00 2001 From: Amir Bandeali Date: Wed, 19 Dec 2018 11:27:10 -0800 Subject: Add note about input validation --- contracts/protocol/contracts/protocol/AssetProxy/MultiAssetProxy.sol | 3 +++ 1 file changed, 3 insertions(+) diff --git a/contracts/protocol/contracts/protocol/AssetProxy/MultiAssetProxy.sol b/contracts/protocol/contracts/protocol/AssetProxy/MultiAssetProxy.sol index 4285725d0..5bc32c214 100644 --- a/contracts/protocol/contracts/protocol/AssetProxy/MultiAssetProxy.sol +++ b/contracts/protocol/contracts/protocol/AssetProxy/MultiAssetProxy.sol @@ -33,6 +33,9 @@ contract MultiAssetProxy is function () external { + // NOTE: The below assembly assumes that clients do some input validation and that the input is properly encoded according to the AbiV2 specification. + // It is technically possible for inputs with very large lengths and offsets to cause overflows. However, this would make the calldata prohibitively expensive + // and we therefore do not check for overflows in these scenarios. assembly { // The first 4 bytes of calldata holds the function selector let selector := and(calldataload(0), 0xffffffff00000000000000000000000000000000000000000000000000000000) -- cgit v1.2.3