aragon / aragonOS / 2285

82%

push

travis-ci

ConversionHelpers: check length on bytes to uint256[] (#509)

There are publicly exposed interfaces that expect `bytes` and immediately turn them into `uint256[]` (e.g. `hasPermission()` in the ACL and Kernel.

There might be some cases where the truncation could lead to Bad Things<sup>TM</sup>, like the ACL being tricked into thinking a contract had permission to do something when it actually didn't. We never use the `bytes` form of `hasPermission()` directly ourselves, so this isn't exploitable, but could be if an external contract decided to.

176 of 178 branches covered (98.88%)

Branch coverage included in aggregate %.

1 of 1 new or added line in 1 file covered. (100.0%)

476 of 477 relevant lines covered (99.79%)

565.94 hits per line