decanus

(platformvm.Genesis) {
 Accounts: ([]platformvm.Account) (len=1 cap=1) {
  (platformvm.Account) {
   Address: (ids.ShortID) 6Y3kysjF9jnHnYkdS9yGAuoHyae2eNmeV,
   Nonce: (uint64) 0,
   Balance: (uint64) 20000000000000
  }
 },
 Validators: (*platformvm.EventHeap)(0xc00011b220)({
  SortByStartTime: (bool) false,

decanus

pragma solidity ^0.4.24;
pragma experimental "v0.5.0";

contract Token {
    
    function transfer(address to, uint256 amount) public returns (bool) {
        return;
    }
}

decanus

With Solidity 0.4.23 a require statement seemingly fail if a contract called has a returndatasize of less than 32. This issue was found when wrapping a transferFrom function call, which doesn't return anything, in a require.

Older contracts that use STOP to return control flow place 1 on the stack through the return of CALL and so RETURNDATASIZE is set to 0. The new require seems to enforce that at least 32 bytes must be returned by the child contract (with RETURNDATASIZE >= 0x20) which seems to break old contracts that simply check whether the return of CALL itself was 1.

The token contract used is Adex.

This issue indicates that any token transfered without a return will fail, affecting any contract using tokens transfers that are wrapped in a require as of solidity v0.4.23

To ensure this really is an issue, we have tried running the code with 2 solidity versions. Essentially wrapping

decanus

pragma solidity 0.4.11;

contract TokenTransferProxy is Ownable {

    modifier onlyAuthorized {
        require(authorized[msg.sender]);
        _;
    }
    
    modifier onlyApprovedByUser(address user) {

decanus

pragma solidity ^0.4.18;

contract Burn {
    
    function Burn() payable {
        selfdestruct(this);
    }
    
}

decanus

Keybase proof

I hereby claim:

• I am decanus on github.
• I am deaneigenmann (https://keybase.io/deaneigenmann) on keybase.
• I have a public key ASDEzE5BG-2Fm2OVdnKHdYtnYSl0gytRY4AVTqiqXn0SUQo

To claim this, I am signing this object: