safe-global / safe-modules / 9806149214

97%

master: 85%

push

github

Check `staticcall` Result From SHA-256 Precompile (#457)

Fixes
https://github.com/hats-finance/Safe-0x<a class=hub.com/safe-global/safe-modules/commit/2909fdefd24a1ced675cb1444918fa766d76bdac">2909fdefd/issues/14,
also see
https://github.com/hats-finance/Safe-0x2909fdefd24a1ced675cb1444918fa766d76bdac/pull/22
for some additional context.

This PR changes the `_sha256` implementation to check the result from
the static call. There is a very subtle bug with not checking, where,
for very large inputs, you would be able to get the precompile to revert
but have the function finish executing successfully (and use whatever is
in the scratch space as the digest).

Note that **we do not check the length of the `returndata`**. This is
intentional and the same thing that the Solidity compiler does for the
builtin `sha256` function.

28 of 28 branches covered (100.0%)

Branch coverage included in aggregate %.

90 of 90 relevant lines covered (100.0%)

30.06 hits per line