Executive brief
ENS (Ethereum Name Service) manages the registration and renewal of .eth domain names on the blockchain. A flaw in the renewal logic allows attackers with controller privileges to force domain expirations by exploiting integer overflow, potentially enabling them to claim others' domains. Currently this requires a malicious DAO controller, but future ENS pricing changes could make it exploitable by any user.
Technical details
The vulnerability is an integer overflow (CWE-190) in the BaseRegistrarImplementation.renew() function. The overflow check uses the expression "expiries[id] + duration + GRACE_PERIOD > duration + GRACE_PERIOD", which can be bypassed by supplying duration = 2^256 - GRACE_PERIOD. This causes both sides to overflow, making the condition evaluate to true despite reducing the expiration time. When expiries[id] += duration then executes, it overflows and reduces the stored expiration timestamp by GRACE_PERIOD. An attacker with controller privileges can repeatedly call renew() with this crafted duration to eventually force domain expiration. Network attack vector with high privilege requirement (PR:H); no user interaction needed. Fix available in version 0.0.22+.
Affected products
- ENS Domains ens-contracts <=0.0.21
Timeline
- 2023-08-01: disclosed
- 2023-08-01: patched: Patch released in version 0.0.22