Skip to content

Instantly share code, notes, and snippets.

@bshastry
Created February 19, 2024 08:29
Show Gist options
  • Save bshastry/295bfc45ccf2b1379ba5fd558241967a to your computer and use it in GitHub Desktop.
Save bshastry/295bfc45ccf2b1379ba5fd558241967a to your computer and use it in GitHub Desktop.
Invalid Deposit assembly via legacy codegen
contract C0 {
fallback() external payable
{
}
function f1() public virtual
{
if ((bytes8(bytes27(bytes10(0x3f0802b2966e365aa0e3))) != bytes8(0x1dcb7a3da18e91f4)))
{
return;
}
else
{
0;
(bool l0, bytes memory l1) = payable(this).call{value: 0}("");
}
assembly
{
let yulinit0 := 0
for
{
let al0 := create2(213, 384, 137, delegatecall(gas(), 2, 288, 69, 352, 158))
}
lt(yulinit0, 1)
{
let yulinit1 := 0
for
{
}
lt(yulinit1, 1)
{
yulinit1 := add(yulinit1, 1)
}
{
}
yulinit0 := add(yulinit0, 1)
}
{
switch tload(256)
case 96
{
}
default
{
}
continue
}
}
uint168 l2 = uint168(uint32((uint32(0) / uint32(0))));
}
address payable immutable s0 = payable(address(this));
event ev0(bytes30 ep0, int112 ep1, address ep2);
}
contract C1 {
address public s1 = address(this);
bool public s2 = false;
address s3;
int200 s4;
constructor(address i0,int200 i1) {
s3 = address(this);
assert(address(this) == s3);
s4 = int200(803469022129495137770981046170581301261101496891396417650687);
assert(int200(803469022129495137770981046170581301261101496891396417650687) == s4);
unchecked {
}
}
struct St0 {
mapping(C0 => int104) el0;
mapping(bytes22 => int200) el1;
}
error er0();
}
contract C2 {
bytes17 s5;
address payable s6;
bytes30 immutable s7;
bool s8 = true;
constructor(bytes17 i0,address payable i1,bytes30 i2) {
s5 = bytes17(bytes24(bytes21(bytes25(0xffffffffffffffffffffffffffffffffffffffffffffffffff))));
assert(bytes17(bytes24(bytes21(bytes25(0xffffffffffffffffffffffffffffffffffffffffffffffffff)))) == s5);
s6 = payable(address(bytes20(address(bytes20(address(0x5992E5e5A202FcA76c37E04dEB7Ef0261FFC3444))))));
assert(payable(address(bytes20(address(bytes20(address(0x5992E5e5A202FcA76c37E04dEB7Ef0261FFC3444)))))) == s6);
s7 = bytes30(bytes7(bytes("b5f0ff")));
assert(bytes30(bytes7(bytes("b5f0ff"))) == s7);
{
do
{
break;
}
while ((bytes24(bytes6(0xffffffffffff)) < bytes24(0x301afde448128c8747b79135adb246ef1ac137bad1f77eaa)));
}
}
event ev1();
}
contract C3 is C1 {
function f2() public virtual payable returns (string memory o0)
{
if (false)
{
assembly
{
for
{ let yulinit2 := 0 } lt(yulinit2, 2) { yulinit2 := add(yulinit2, 1) }
{
break
}
let al1 := delegatecall(gas(), 6, 320, 75, 128, 157)
function af0(ai0, ai1, ai2, ai3, ai4, ai5, ai6, ai7) -> ao0, ao1, ao2, ao3, ao4, ao5, ao6, ao7, ao8, ao9, ao10, ao11, ao12, ao13, ao14, ao15, ao16, ao17, ao18
{
mstore8(384, ai1)
calldatacopy(384, 128, 186)
}
o0 := 352
}
for( C1 l0 = C1(address(this));
true;
uint64(uint160((uint240(723964996230949894793698511955299589003043710440367181090001164926685845) - uint240(1766847064778384329583297500742918515827483896875618958121606201292619775)))))
{
break;
}
}
}
function f3(bool i0,address payable i1) public returns (bytes4 o0,bool o1)
{
if (i1 <= payable(address(this)))
{
if (i0)
{
(o0) = (bytes4(bytes6(bytes29(0x3a8f648d63ae05ec5bad1708ca1dadbd5ec7757bdf2ef57a108562f0e8))));
assert(o0 == bytes4(bytes6(bytes29(0x3a8f648d63ae05ec5bad1708ca1dadbd5ec7757bdf2ef57a108562f0e8))));
}
else if (i0)
{
revert C1.er0();
}
}
if (i0)
{
(bool l0, bytes memory l1) = payable(this).call{value: 0}("");
}
}
uint112 s9 = uint112(5192296858534827628530496329220095);
C0 immutable s10;
constructor(C0 i0) C1(address(bytes20(bytes25(bytes13(0x00000000000000000000000000)))), ((int200(0) | int200(0)) - int200(803469022129495137770981046170581301261101496891396417650687)))
{
s10 = C0(payable(address(this)));
assert(C0(payable(address(this))) == s10);
unchecked {
}
}
fallback() external payable
{
(s9) = (uint112(68769575972827704063245335870534));
assert(s9 == uint112(68769575972827704063245335870534));
assembly
{
tstore(gt(call(gas(), 3, 153, 352, 19, 256, 183), exp(192, 128)), mload(224))
}
C0 l0 = s10;
C0 l1 = l0;
assert(l1 == s10);
}
}
contract C4 {
uint48 public s11;
constructor(uint48 i0) {
s11 = uint48(0);
assert(uint48(0) == s11);
unchecked {
}
}
fallback() external virtual
{
}
error er1();
struct St1 {
C1.St0 el0;
uint208 el1;
uint144 el2;
bool el3;
}
}
contract C5 {
struct St2 {
bool el0;
function (bool[] memory, uint160, string memory) external returns (bool, function () external returns (bool, address)) el1;
bytes el2;
C0 el3;
}
enum EN0 {
M0, M1, M2, M3, M4, M5, M6, M7,
M8, M9, M10, M11, M12, M13, M14, M15,
M16, M17, M18, M19, M20, M21, M22, M23,
M24, M25, M26, M27, M28, M29, M30, M31,
M32, M33, M34, M35, M36, M37, M38, M39,
M40, M41, M42, M43, M44, M45, M46, M47,
M48, M49, M50, M51, M52, M53, M54, M55,
M56, M57, M58, M59, M60, M61, M62, M63,
M64, M65, M66, M67, M68, M69, M70, M71,
M72, M73, M74, M75, M76, M77, M78, M79,
M80, M81, M82, M83, M84, M85, M86, M87,
M88, M89, M90, M91, M92, M93, M94, M95,
M96, M97, M98, M99, M100, M101, M102, M103,
M104, M105, M106, M107, M108, M109, M110, M111,
M112, M113, M114, M115, M116, M117, M118, M119,
M120, M121, M122, M123, M124, M125, M126, M127,
M128, M129, M130, M131, M132, M133, M134, M135,
M136, M137, M138, M139, M140, M141, M142, M143,
M144, M145, M146, M147, M148, M149, M150, M151,
M152, M153, M154, M155, M156, M157, M158, M159,
M160, M161, M162, M163, M164, M165, M166, M167,
M168, M169, M170, M171, M172, M173, M174, M175,
M176, M177, M178, M179, M180, M181, M182, M183,
M184, M185, M186, M187, M188, M189, M190, M191,
M192, M193, M194, M195, M196
}
function f6(address payable i0) external virtual payable
{
try this.f6(payable(address(bytes20(address(0xFFfFfFffFFfffFFfFFfFFFFFffFFFffffFfFFFfF)))))
{
if (i0 <= payable(address((bytes20(address(this)) ^ bytes20(address(0xFFfFfFffFFfffFFfFFfFFFFFffFFFffffFfFFFfF))))))
{
revert C4.er1();
}
else if (i0 <= payable(address(this)))
{
(bool l0, bytes memory l1) = address(this).call(bytes("1995"));
}
delete i0;
if (i0 < payable(address(this)))
{
try this.f6(payable(address(this)))
{
}
catch
{
if (i0 == payable(address(bytes20(bytes1(bytes9(0xdeb0342d5c5c3c45c4))))))
{
}
(bool l2, bytes memory l3) = address(this).call(bytes(string("96216")));
if (i0 == payable(address(bytes20(address(bytes20(address(0x0000000000000000000000000000000000000000)))))))
{
if (i0 >= payable(address(bytes20(bytes23(bytes28(0x00000000000000000000000000000000000000000000000000000000))))))
{
}
else if (i0 <= payable(address(bytes20(bytes9(bytes30(0xfeec292baf918d541baf55f75b5f61c5f66978c3e98df8fdd407f655bc99))))))
{
assembly
{
switch delegatecall(gas(), 2, 160, 43, 256, 243)
default
{
stop()
}
switch blobbasefee()
default
{
let yulinit3 := 0
for
{
}
lt(yulinit3, 1)
{
yulinit3 := add(yulinit3, 1)
}
{
}
for
{ let yulinit4 := 0 } lt(yulinit4, 1) { yulinit4 := add(yulinit4, 1) }
{
}
}
selfdestruct(create(107, 288, 201))
}
}
assembly
{
switch 192
case 960
{
l3 := shl(call(gas(), 3, 244, 320, 44, 128, 6), blobbasefee())
}
}
}
else
{
if (i0 <= payable(address(this)))
{
assembly
{
}
if (i0 > payable(address(bytes20(address(bytes20(address(0xFFfFfFffFFfffFFfFFfFFFFFffFFFffffFfFFFfF)))))))
{
assembly
{
}
revert C1.er0();
}
else
{
assembly
{
}
return;
}
}
}
}
}
}
catch
{
}
}
bytes6 immutable public s12;
constructor(bytes6 i0) {
s12 = bytes6(0xa6d3d9d4ac31);
assert(bytes6(0xa6d3d9d4ac31) == s12);
unchecked {
}
}
}
contract C6 is C5 {
event ev2();
function f7() public virtual payable
{
assembly
{
}
assembly
{
}
bytes20 l0 = bytes20(address(bytes20(address(0x0000000000000000000000000000000000000000))));
(bool l1, bytes memory l2) = address(this).call(bytes("8c08"));
assembly
{
extcodecopy(5, 352, 160, 7)
mcopy(288, 288, 21)
sstore(tload(384), l2)
pop(or(eq(672, 768), create2(240, 384, 126, 192)))
}
}
string[] public s13 = [string("b30ec"), string("251"), string("25c"), string("aa6"), string("6dd5"), string("9e8"), string("57")];
function compareMemoryAndStorage(string[] memory v1, string[] storage v2) internal returns (bool) {
if (v1.length != v2.length)
return false;
for (uint i = 0; i < v1.length; i++)
if (!compareMemoryAndStorage(v1[i], v2[i]))
return false;
return true;
}
function compareMemoryAndStorage(string memory v1, string storage v2) internal pure returns (bool) {
return keccak256(bytes(v1)) == keccak256(bytes(v2));
}
uint232 s14;
constructor(uint232 i0) payable C5(bytes6(bytes1(bytes27(bytes8(0x0000000000000000)))))
{
s14 = (uint232(6064071794061397502300450775015763020433190670107331431790851823110327) ** uint120(uint120(C5.EN0.M167)));
assert((uint232(6064071794061397502300450775015763020433190670107331431790851823110327) ** uint120(uint120(C5.EN0.M167))) == s14);
unchecked {
}
}
function compareMemoryAndCalldata(string[] memory v1, string[] calldata v2) internal returns (bool) {
if (v1.length != v2.length)
return false;
for (uint i = 0; i < v1.length; i++)
if (!compareMemoryAndCalldata(v1[i], v2[i]))
return false;
return true;
}
function compareMemoryAndCalldata(string memory v1, string calldata v2) internal pure returns (bool) {
return keccak256(bytes(v1)) == keccak256(bytes(v2));
}
function f8(uint232 i0,string[] calldata i1) public payable
{
emit ev2();
return;
}
function f6(address payable i0) external virtual override payable
{
if (i0 != payable(address((bytes20(bytes32(0xffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff)) | bytes20(address(0xf52AA94996b8766889523447131865F744B062D9))))))
{
assembly
{
mcopy(384, 320, 78)
function af1(ai8, ai9, ai10, ai11, ai12, ai13, ai14, ai15, ai16, ai17, ai18, ai19, ai20) -> ao19, ao20, ao21, ao22, ao23, ao24, ao25, ao26, ao27, ao28, ao29
{
switch shr(tload(320), delegatecall(gas(), 1, 352, 157, 160, 176))
case 224
{
}
let al2 := 288
if create2(139, 352, 66, ai17)
{
}
}
}
if (i0 > payable(address(bytes20(address(0x0000000000000000000000000000000000000000)))))
{
if (i0 != payable(address(this)))
{
(s13[uint256(109712615370473516090991024148564643350142371934822263948150782388704715082325)]) = (s13[uint256(((uint256(6291937191847786380395732951162953319681526533410404163636549545159546528130) - uint256(1302181310933464164297280985153903605942592202738731708981079754764747898816)) / uint256(0)))]);
assert(keccak256(bytes(s13[uint256(109712615370473516090991024148564643350142371934822263948150782388704715082325)])) == keccak256(bytes(s13[uint256(((uint256(6291937191847786380395732951162953319681526533410404163636549545159546528130) - uint256(1302181310933464164297280985153903605942592202738731708981079754764747898816)) / uint256(0)))])));
emit ev2();
}
}
emit ev2();
}
else if (i0 >= payable(address(this)))
{
assembly
{
extcodecopy(3, 192, 352, 131)
}
assembly
{
}
revert C4.er1();
}
}
}
contract C7 is C4 {
bool immutable s15;
mapping(int192 => C5) s16;
C5.EN0 s17;
mapping(uint168 => address) s18;
constructor(bool i0,C5.EN0 i1) C4((uint48(228004889163653) * (uint48(212548593806858) | uint48(281474976710655))))
{
s15 = (address(bytes20(address(this))) > address(this));
assert((address(bytes20(address(this))) > address(this)) == s15);
s17 = C5.EN0.M128;
assert(C5.EN0.M128 == s17);
s16[int192(3138550867693340381917894711603833208051177722232017256447)] = C5(address(this));
assert(C5(address(this)) == s16[int192(3138550867693340381917894711603833208051177722232017256447)]);
s18[uint168(int168(uint168(25316092373890305670144885175491888442434488111461)))] = address(bytes20(address(0x0000000000000000000000000000000000000000)));
assert(address(bytes20(address(0x0000000000000000000000000000000000000000))) == s18[uint168(int168(uint168(25316092373890305670144885175491888442434488111461)))]);
unchecked {
}
}
receive() external payable
{
}
struct St3 {
uint120 el0;
bool el1;
C1 el2;
uint24 el3;
}
fallback() external override
{
}
}
contract C8 {
fallback() external
{
}
uint104 s19;
bool public s20;
address[] s21 = [address(0x0000000000000000000000000000000000000008), address(0x0000000000000000000000000000000000000001), address(0x0000000000000000000000000000000000000003), address(0x0000000000000000000000000000000000000003), address(0x0000000000000000000000000000000000000005)];
function compareMemoryAndStorage(address[] memory v1, address[] storage v2) internal returns (bool) {
if (v1.length != v2.length)
return false;
for (uint i = 0; i < v1.length; i++)
if (v1[i] != v2[i])
return false;
return true;
}
bool s22 = false;
constructor(uint104 i0,bool i1) {
s19 = (uint104(19821075477901296726918621498043) * (uint104(11474073637329077033527166293254) >> uint64(uint64(0))));
assert((uint104(19821075477901296726918621498043) * (uint104(11474073637329077033527166293254) >> uint64(uint64(0)))) == s19);
s20 = false;
assert(false == s20);
{
}
}
function f13() external
{
}
error er2();
}
contract C9 {
error er3(uint224 ep0);
bytes5 s23;
bytes29 immutable s24 = bytes29(0xffffffffffffffffffffffffffffffffffffffffffffffffffffffffff);
constructor(bytes5 i0) {
s23 = bytes5(bytes5(bytes12(bytes11(0x52148ea7540106862151f4))));
assert(bytes5(bytes5(bytes12(bytes11(0x52148ea7540106862151f4)))) == s23);
{
}
}
function f14() external virtual payable returns (function (bytes4) external returns (C7.St3 memory, bool) o0)
{
bytes5 l0 = s23;
bytes5 l1 = l0;
assert(l1 == s23);
}
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment