Ambiguity in string format conversion

[tomtau]

KS-THA-F-11
https://github.com/tharsis/ethermint/blob/main/crypto/hd/algorithm.go#L62

ParseDerivationPath parses strings starting with 0 to octal values, and strings starting with 0x and 0b to hexadecimal and binary values, respectively. This can easily cause collisions in the resulting address, which can be exploited e.g. with a JSON-RPC call:

      ~ curl -X POST --data
 '{"jsonrpc":"2.0","method":"web3_sha3","params":["0x"],"id":1}' -H "Content-Type:
 application/json" http://localhost:8545
 {"jsonrpc":"2.0","id":1,"result":"0xc5d2460186f7233c927e7db2dcc703c0e500b653ca82273
 b7bfad8045d85a470"}
 ~ curl -X POST --data '{"jsonrpc":"2.0","method":"web3_sha3","params":[""],"id":1}'
 -H "Content-Type: application/json" http://localhost:8545
 {"jsonrpc":"2.0","id":1,"result":"0xc5d2460186f7233c927e7db2dcc703c0e500b653ca82273
 b7bfad8045d85a470"}
 ~ curl -X POST --data '{"jsonrpc":"2.0","method":"web3_sha3","params":[""],"id":1}'
 -H "Content-Type: application/json" http://localhost:8545
 ~ curl -X POST --data
 '{"jsonrpc":"2.0","method":"web3_sha3","params":["ab"],"id":1}' -H "Content-Type:
 application/json" http://localhost:8545 {"jsonrpc":"2.0","id":1,"error":{"code":-
 32602,"message":"invalid argument 0: json: cannot unmarshal hex string without 0x
 prefix into Go value of type hexutil.Bytes"}}

We recommend making the parsing rules stricter in order to avoid this ambiguity.

[github-actions]

This issue is stale because it has been open 45 days with no activity. Remove Status: Stale label or comment or this will be closed in 7 days.

[WilliamXieCrypto]

There have two problems from this issue:

1. JSON-RPC endpoint "web3_sha3" have an ambiguity result, like get the same result with “” and “0x”.
2. ParseDerivationPath parses strings can easily cause collisions in the resulting address, which maybe can be exploited.

I will fix the problem 1.
For the problem 2, the ParseDerivationPath is from go-ethereum lib and I have checked and test some cases like "0x"/"0X"/"0"/"0b"/"0B"... seems normal for me, I think we can raise another issue to go-ethereum repo if we find some issues.