Sigvex
EVMRemediation2 min read

Solc Calldata Re-encode Bugs Remediation

How to remediate the ABI-encoder calldata re-encoding bugs by recompiling with a patched compiler and redeploying.

evmcompiler-bug

Solc Calldata Re-encode Bugs Remediation

Overview

Related Detector: Solc Calldata Re-encode Bugs

Two related ABI-encoder bugs corrupt data when calldata is re-encoded directly into an external call. One skipped the calldatasize() bounds check on the direct calldata-to-encoder path for nested dynamic arrays; the other performed an over-eager 32-byte cleanup after a statically sized trailing array, zeroing the first word of the following dynamic component. Both are compiler bugs, so the fix is to recompile with a patched compiler and redeploy — no source change makes an affected compiler safe.

// Affected: Solidity ABI encoder, calldata re-encoded directly into an external
//   call (nested dynamic arrays; static array followed by a dynamic tuple).
//   Disclosed in the 2022-05 and 2022-08 advisories.
// Fixed in: the patched compiler releases identified in the official bug list.

// Pin to a compiler at or after the fix and rebuild:
pragma solidity ^0.8.17;   // confirm the exact fixed version against the bug list below

Steps:

  1. Consult the Solidity known bugs list for the exact affected/fixed versions for your compiler line.
  2. Recompile with a patched version and redeploy.
  3. As a defensive measure, avoid re-emitting untrusted calldata directly into an external call; decode, validate, then re-encode from typed values.

Common Mistakes

  • Treating it as an input-validation bug in the contract rather than an encoder bug in the compiler.
  • Forwarding raw calldata into a downstream call for efficiency, maximizing exposure to the re-encode path.
  • Redeploying with a local compiler that predates the fix.

References