ajayss - User will get same hash when attestation details are modified slightly

[sherlock-admin2]

ajayss

Medium

User will get same hash when attestation details are modified slightly

Summary

The hash for creating attestation encodes multiple string based values into a bytes object before hashing it.

However the problem comes when the string manipulation like
~ service : "ABC" , evidence: "D"
can be put as
~ service : "AB", evidence : "CD"

@> return keccak256(abi.encodePacked(profileId, randValue, account, service, evidence));

@> return keccak256(abi.encodePacked(service, account));

and get the same hash as the abi.encodePacked method is used.

Root Cause

the abi.encodePacked method clubs all the strings together, so basic manipulation like these may lead to the same for ServiceAndAccountHash and CreateAttestation

1, 2

Internal pre-conditions

No response

External pre-conditions

No response

Attack Path

No response

Impact

Hash conflict can be easily created affecting mapping storage variables like attestationByHash for its integrity.

PoC

No response

Mitigation

use abi.encode for group of dynamic data types like bytes and strings.