From 0798e8e17ad058a8117539c062c774e97d976a79 Mon Sep 17 00:00:00 2001 From: Chef Snoopy Date: Wed, 22 Jul 2026 19:43:45 +0800 Subject: [PATCH 1/2] fix: BytesLib.toLengthOffset bounds check --- snapshots/BinNativePancakeSwapInfinityTest.json | 8 ++++---- snapshots/BinPancakeSwapInfinityTest.json | 14 +++++++------- snapshots/CLNativePancakeSwapInfinityTest.json | 6 +++--- snapshots/CLPancakeSwapInfinityTest.json | 14 +++++++------- snapshots/UniversalRouterTest.json | 4 ++-- src/libraries/BytesLib.sol | 8 +++++--- 6 files changed, 28 insertions(+), 26 deletions(-) diff --git a/snapshots/BinNativePancakeSwapInfinityTest.json b/snapshots/BinNativePancakeSwapInfinityTest.json index a3c5045..ccc62bd 100644 --- a/snapshots/BinNativePancakeSwapInfinityTest.json +++ b/snapshots/BinNativePancakeSwapInfinityTest.json @@ -1,6 +1,6 @@ { - "test_infiBinSwap_ExactInSingle_NativeIn": "128863", - "test_infiBinSwap_ExactInSingle_NativeOut": "117561", - "test_infiBinSwap_ExactInSingle_NativeOut_RouterRecipient": "117850", - "test_infiBinSwap_infiInitializeBinPool": "132794" + "test_infiBinSwap_ExactInSingle_NativeIn": "129146", + "test_infiBinSwap_ExactInSingle_NativeOut": "117925", + "test_infiBinSwap_ExactInSingle_NativeOut_RouterRecipient": "118278", + "test_infiBinSwap_infiInitializeBinPool": "132834" } \ No newline at end of file diff --git a/snapshots/BinPancakeSwapInfinityTest.json b/snapshots/BinPancakeSwapInfinityTest.json index ae78331..c615e38 100644 --- a/snapshots/BinPancakeSwapInfinityTest.json +++ b/snapshots/BinPancakeSwapInfinityTest.json @@ -1,9 +1,9 @@ { - "test_infiBinSwap_ExactInSingle": "143463", - "test_infiBinSwap_ExactIn_MultiHop": "174857", - "test_infiBinSwap_ExactIn_SingleHop": "145261", - "test_infiBinSwap_ExactOutSingle": "147825", - "test_infiBinSwap_ExactOut_MultiHop": "178705", - "test_infiBinSwap_ExactOut_SingleHop": "149633", - "test_infiBinSwap_InitializeBinPool": "152934" + "test_infiBinSwap_ExactInSingle": "143827", + "test_infiBinSwap_ExactIn_MultiHop": "175892", + "test_infiBinSwap_ExactIn_SingleHop": "145923", + "test_infiBinSwap_ExactOutSingle": "148195", + "test_infiBinSwap_ExactOut_MultiHop": "179796", + "test_infiBinSwap_ExactOut_SingleHop": "150323", + "test_infiBinSwap_InitializeBinPool": "152974" } \ No newline at end of file diff --git a/snapshots/CLNativePancakeSwapInfinityTest.json b/snapshots/CLNativePancakeSwapInfinityTest.json index c3d2b0b..06ed119 100644 --- a/snapshots/CLNativePancakeSwapInfinityTest.json +++ b/snapshots/CLNativePancakeSwapInfinityTest.json @@ -1,5 +1,5 @@ { - "test_infiClSwap_ExactInSingle_NativeIn": "161904", - "test_infiClSwap_ExactInSingle_NativeOut": "144640", - "test_infiClSwap_infiInitializeClPool": "133576" + "test_infiClSwap_ExactInSingle_NativeIn": "162274", + "test_infiClSwap_ExactInSingle_NativeOut": "145091", + "test_infiClSwap_infiInitializeClPool": "133610" } \ No newline at end of file diff --git a/snapshots/CLPancakeSwapInfinityTest.json b/snapshots/CLPancakeSwapInfinityTest.json index 50ce37b..ddb4683 100644 --- a/snapshots/CLPancakeSwapInfinityTest.json +++ b/snapshots/CLPancakeSwapInfinityTest.json @@ -1,9 +1,9 @@ { - "test_infiClSwap_ExactInSingle": "176504", - "test_infiClSwap_ExactIn_MultiHop": "240950", - "test_infiClSwap_ExactIn_SingleHop": "178295", - "test_infiClSwap_ExactOutSingle": "180828", - "test_infiClSwap_ExactOut_MultiHop": "244726", - "test_infiClSwap_ExactOut_SingleHop": "182631", - "test_infiClSwap_infiInitializeClPool": "153704" + "test_infiClSwap_ExactInSingle": "176955", + "test_infiClSwap_ExactIn_MultiHop": "242129", + "test_infiClSwap_ExactIn_SingleHop": "179029", + "test_infiClSwap_ExactOutSingle": "181285", + "test_infiClSwap_ExactOut_MultiHop": "245991", + "test_infiClSwap_ExactOut_SingleHop": "183408", + "test_infiClSwap_infiInitializeClPool": "153738" } \ No newline at end of file diff --git a/snapshots/UniversalRouterTest.json b/snapshots/UniversalRouterTest.json index 854268a..89c1e01 100644 --- a/snapshots/UniversalRouterTest.json +++ b/snapshots/UniversalRouterTest.json @@ -1,4 +1,4 @@ { - "UniversalRouterBytecodeSize": "22521", - "test_sweep_token": "55429" + "UniversalRouterBytecodeSize": "23228", + "test_sweep_token": "55452" } \ No newline at end of file diff --git a/src/libraries/BytesLib.sol b/src/libraries/BytesLib.sol index 389ee81..dd855d5 100755 --- a/src/libraries/BytesLib.sol +++ b/src/libraries/BytesLib.sol @@ -34,16 +34,18 @@ library BytesLib { pure returns (uint256 length, uint256 offset) { - uint256 relativeOffset; assembly { // The offset of the `_arg`-th element is `32 * arg`, which stores the offset of the length pointer. // shl(5, x) is equivalent to mul(32, x) let lengthPtr := add(_bytes.offset, calldataload(add(_bytes.offset, shl(5, _arg)))) length := calldataload(lengthPtr) offset := add(lengthPtr, 0x20) - relativeOffset := sub(offset, _bytes.offset) + let relativeOffset := sub(offset, _bytes.offset) + if lt(_bytes.length, add(shl(5, length), relativeOffset)) { + mstore(0, 0x3b99b53d) // SliceOutOfBounds() + revert(0x1c, 0x04) + } } - if (_bytes.length < length + relativeOffset) revert SliceOutOfBounds(); } /// @notice Returns the pool details starting at byte 0 From 4b82f522e88c20257e1cd79b6eab8880f7213328 Mon Sep 17 00:00:00 2001 From: Chef Snoopy Date: Wed, 22 Jul 2026 19:45:45 +0800 Subject: [PATCH 2/2] chore: Update snapshots --- snapshots/StableSwapBusdUsdcTest.json | 4 ++-- snapshots/V2BnbCake.json | 4 ++-- snapshots/V2MockBnb.json | 4 ++-- snapshots/V3BnbCake.json | 10 +++++----- 4 files changed, 11 insertions(+), 11 deletions(-) diff --git a/snapshots/StableSwapBusdUsdcTest.json b/snapshots/StableSwapBusdUsdcTest.json index dd9c422..066e16a 100644 --- a/snapshots/StableSwapBusdUsdcTest.json +++ b/snapshots/StableSwapBusdUsdcTest.json @@ -1,4 +1,4 @@ { - "test_stableSwap_ExactInput0For1": "193988", - "test_stableSwap_ExactInput1For0": "194056" + "test_stableSwap_ExactInput0For1": "194400", + "test_stableSwap_ExactInput1For0": "194468" } \ No newline at end of file diff --git a/snapshots/V2BnbCake.json b/snapshots/V2BnbCake.json index 296597a..ac0b076 100644 --- a/snapshots/V2BnbCake.json +++ b/snapshots/V2BnbCake.json @@ -1,4 +1,4 @@ { - "test_v2Swap_exactInput0For1": "116435", - "test_v2Swap_exactOutput0For1": "117038" + "test_v2Swap_exactInput0For1": "117142", + "test_v2Swap_exactOutput0For1": "117362" } \ No newline at end of file diff --git a/snapshots/V2MockBnb.json b/snapshots/V2MockBnb.json index 1bacec2..bedcd21 100644 --- a/snapshots/V2MockBnb.json +++ b/snapshots/V2MockBnb.json @@ -1,4 +1,4 @@ { - "test_v2Swap_exactInput0For1": "100167", - "test_v2Swap_exactOutput0For1": "100791" + "test_v2Swap_exactInput0For1": "100880", + "test_v2Swap_exactOutput0For1": "101121" } \ No newline at end of file diff --git a/snapshots/V3BnbCake.json b/snapshots/V3BnbCake.json index 74c33a8..b0d0c6a 100644 --- a/snapshots/V3BnbCake.json +++ b/snapshots/V3BnbCake.json @@ -1,7 +1,7 @@ { - "test_v3Swap_ExactInput0For1": "151871", - "test_v3Swap_ExactInput0For1_ContractBalance": "154778", - "test_v3Swap_exactInput_MultiHop": "243288", - "test_v3Swap_exactOutput0For1": "150573", - "test_v3Swap_exactOutput_MultiHop": "254218" + "test_v3Swap_ExactInput0For1": "152417", + "test_v3Swap_ExactInput0For1_ContractBalance": "155472", + "test_v3Swap_exactInput_MultiHop": "244408", + "test_v3Swap_exactOutput0For1": "151054", + "test_v3Swap_exactOutput_MultiHop": "255186" } \ No newline at end of file