CVE-2026-32322 soroban-sdk Fr类型比较逻辑漏洞

// PoC: Fr comparison vulnerability demonstration // This demonstrates how unreduced Fr values can bypass equality checks // Vulnerable comparison (current implementation) fn vulnerable_fr_equal(a: Fr, b: Fr) -> bool { // Direct U256 comparison without modulo reduction a.0 == b.0 } // Example attack scenario: // Contract checks if user-provided scalar equals authorized value fn vulnerable_auth_check(user_scalar: Fr, authorized_scalar: Fr) -> bool { // This check can be bypassed if user_scalar is unreduced // e.g., authorized_scalar = 0, user_scalar = r (field modulus) // They are mathematically equal but compare as NOT equal vulnerable_fr_equal(user_scalar, authorized_scalar) } // Exploit: // 1. authorized_scalar = 0 (mod r) // 2. Attacker provides user_scalar = r (unreduced) // 3. vulnerable_auth_check returns false (incorrectly) // 4. Attacker bypasses authorization // Fixed comparison (after patch) fn fixed_fr_equal(a: Fr, b: Fr) -> bool { // Reduce both values modulo r before comparison let reduced_a = a.reduce(); let reduced_b = b.reduce(); reduced_a.0 == reduced_b.0 }