fix(evm): prevent uint64→int64 overflow in transfer path - #1303
Merged
Conversation
bysomeone
changed the title
libangzhu
approved these changes
Jul 30, 2026
bysomeone
force-pushed
the
fix/evm-uint64-overflow-in-transfer
branch
from
July 30, 2026 03:05
edc0120 to
0c8f7ef
Compare
…ction - types: ForkEVMFixOverflow constant and registration - statedb.go: MaxInt64 guard in CanTransfer - evm.go: check Transfer return value in Call()/Create(), revert on failure - exec.go: check Transfer return value in transfer-only path - token.go: IsInt64() guard in precompile transfer Co-Authored-By: Claude <noreply@anthropic.com>
- evmxgo/transwithdraw.go: recv += overflow check - cross2eth/chain33.go: IsInt64() check before Int64() in bridge amounts Co-Authored-By: Claude <noreply@anthropic.com>
- statedb_test.go: fork-gate overflow protection unit tests - attack_integration_test.go: multi-signer Exec-level WBTY attack simulation Co-Authored-By: Claude <noreply@anthropic.com>
Complete documentation covering attack chain, root cause, fork control, cross-chain audit findings, and defense-in-depth fix rationale. Co-Authored-By: Claude <noreply@anthropic.com>
bysomeone
force-pushed
the
fix/evm-uint64-overflow-in-transfer
branch
from
July 30, 2026 06:34
f8d4206 to
1aa9c7e
Compare
- chain33.para.toml: used by paracross/rollup/rgbx CI - chain33.fork.toml: fork config base - ci2/chain33.proxyminer.toml: used by evm2 proxyminer CI (non-local) Co-Authored-By: Claude <noreply@anthropic.com>
bysomeone
force-pushed
the
fix/evm-uint64-overflow-in-transfer
branch
from
July 30, 2026 07:45
e30730d to
dd58a96
Compare
bysomeone
changed the title
33cn
approved these changes
Jul 30, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
修复 EVM 层 uint64→int64 整数溢出漏洞，阻止攻击者绕过余额检查零成本铸造 WBTY。
Attack
攻击者通过 protobuf varint 编码在 RPC 入口绕过 EvmContractCallReq.Amount (int64) 的限制，传入接近 2^64 的值。该值在 MemoryStateDB.CanTransfer 中被转换为 int64 时溢出为负数，导致余额检查恒成立，同时 Transfer 返回值被丢弃，合约以原始 uint64 值执行。
结果：攻击者零成本铸造 ~1844 亿 WBTY，随后 withdraw 兑走真 BTY。
Fix
所有校验放在资产操作的边界上，通过 ForkEVMFixOverflow 分叉控制生效。
4 个 commit：
fc8888fc0fecdfbce0afc1aa9c7e分叉保护点
CanTransferevm.Call/Createexec.innerExectoken precompile无需分叉
Transfer本身value < 0 → false分叉前后一致AssembleChain33Tx有精度转换保护🤖 Generated with Claude Code
Co-Authored-By: Claude noreply@anthropic.com