pumpkinseed / eip55-rs Goto Github PK

This library depends on unmaintained and vulnerable rust-crypto. This probably doesn't introduce any security issue, but it would be nice to replace it with something modern like sha3 crate from RustCryptoOrg.

https://rustsec.org/advisories/RUSTSEC-2016-0005.html
https://rustsec.org/advisories/RUSTSEC-2022-0011.html

Please consider the following snippet I've tried it on replit:

// correct checksum
const ADDRESS: &str = "0x000000000000000000000000000000000000dEaD";

fn main() {
  // NOTE: This is incorrect, valid form is `..dEaD` as above
  assert_eq!(
    checksum("0x000000000000000000000000000000000000dEAD"),
    "0x000000000000000000000000000000000000dEAD");

  // and hence wrong result here
  assert_eq!(
    validate_address("0x000000000000000000000000000000000000dEAD"),
    true);
}

Steps to reproduce

eip55::validate_address("Îñţérñåţîöñåļîžåţîờñ");

Panics with:

byte index 1 is not a char boundary; it is inside 'Î' (bytes 0..2) of `Îñţérñåţîöñåļîžåţîờñ`
thread 'project::test::check_invalid_addresses' panicked at 'byte index 1 is not a char boundary; it is inside 'Î' (bytes 0..2) of `Îñţérñåţîöñåļîžåţîờñ`'

I'm using the latest version:

eip55 = "0.3"

Describe the bug

When passing a string without a prefix, the checksum() function fails.

The function accepts both prefixed and non-prefixed strings. However, indexing for characters is performed without taking this into account. This results in a panic during execution.