Ripple - Smart Contract Audit - Permissioned Domains - Ripple

When creating a permissioned domain via the PermissionedDomainSet transaction, the creator needs to pass an array of credential objects to the transaction. This array is validated against duplicates during the preliminary verifications, and used to construct the permissioned domain object in a second part.

During the permissioned domain object creation, the function iterates through each credential objects of the parameters and inserts them in a map. If the object is already present, an empty map would be returned. While the code is in this state protected against duplicates due to the aforementioned verification, it would gain to be more robust and return an error instead of an empty map to handle codebase updates without potential bugs.

Code Location

• src/xrpld/app/misc/CredentialHelpers.cpp: the following snippet shows the aforementioned preliminary verification, ensuring that the credential array does not contain duplicates.

auto [it, ins] = duplicates.insert(sha512Half(issuer, ct));
if (!ins)
{
    JLOG(j.trace()) << "Malformed transaction: "
                        "duplicates in credenentials.";
    return temMALFORMED;
}

• src/xrpld/app/misc/CredentialHelpers.cpp: the function returns an empty map if a duplicate is found, and could be improved by returning an error.

std::set<std::pair<AccountID, Slice>>
makeSorted(STArray const& credentials)
{
    std::set<std::pair<AccountID, Slice>> out;
    for (auto const& cred : credentials)
    {
        auto [it, ins] = out.emplace(cred[sfIssuer], cred[sfCredentialType]);
        if (!ins)
            return {};
    }
    return out;
}

• src/xrpld/app/tx/detail/PermissionedDomainSet.cpp: the permissioned domain object creation invokes the above function, not checking for empty content either.

TER
PermissionedDomainSet::doApply() // @note apply the transaction to the ledger
{
    // @note not sure the need to check if the ownerSle exists since
    // it's initialized in the transactor
    auto const ownerSle = view().peek(keylet::account(account_));
    if (!ownerSle)
        return tefINTERNAL;  // LCOV_EXCL_LINE

    auto const sortedTxCredentials =
        credentials::makeSorted(ctx_.tx.getFieldArray(sfAcceptedCredentials));
    STArray sortedLE(sfAcceptedCredentials, sortedTxCredentials.size());
    for (auto const& p : sortedTxCredentials)
    {
        auto cred = STObject::makeInnerObject(sfCredential);
        cred.setAccountID(sfIssuer, p.first);
        cred.setFieldVL(sfCredentialType, p.second);
        sortedLE.push_back(std::move(cred));
    }

It is recommended to return an error instead of an empty map.

ACKNOWLEDGED: The Ripple team acknowledged this finding.