Skip to content

derive: Forbid SetCode batches with contract creation bit set in span batches #14880

@sebastianst

Description

@sebastianst

In this comment @tynes discovered a possible nil-pointer dereference. In spanBatchTxs.fullTxs, the to address pointer is only set if this is not a contract creation. But a maliciously formed span batch may set this bit for a setCode tx. We need to check for this and return an error.

Metadata

Metadata

Assignees

Labels

A-derivationArea: derivation changes (op-node/rollup/derive)C-bugCategory: bugsH-isthmusHardfork: change is planned for isthmus upgrade

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions