george0papasotiriou/cve-2026-23008-solidity-assembly-return-data-size-confusionEducational PoC for Solidity assembly return-data size confusion; includes vulnerable contract, exploit simulation, and mitigation guidance for secure ABI decoding.
// ReturnSizeConfusion.sol
contract Victim {
function callExternal(address target) external returns (bytes memory) {
(bool success, bytes memory ret) = target.call(abi.encodeWithSignature("someFunc()"));
require(success, "call failed");
// Vulnerability: assumes ret is at least 32 bytes, but could be empty
uint256 value;
assembly {
value := mload(add(ret, 32))
}
return ret;
}
}
A Solidity contract uses inline assembly to read a returned value but does not validate that the return data length is sufficient. An attacker can return empty data, causing the assembly to read arbitrary stack data, leading to memory corruption or security bypass.
Deploy the vulnerable contract and an attacker contract that returns an empty response. The mload reads stale data.
ret before accessing via assembly.abi.decode) instead of raw assembly.git clone https://github.com/yourorg/CVE-2026-23008.git
cd CVE-2026-23008
# Use Foundry to test