cargo contract verify does not re-hash wasm

[R9295]

Summary

An attacker can deploy a malicious contract and have cargo contract verify incorrectly approve the malicious contract because the wasm code is not re-hashed.

Issue details

A file.contract that includes the correct source.hash field for a project but the incorrect source.wasm field will be validated by cargo contract verify --contract file.contract, even though it does not match the source code's output.

Steps to reproduce

An attacker could abuse this issue in the following way:

1. Write a contract.
2. Build the contract. This build will now be referred to as legit.contract.
3. Modify the contract to insert a backdoor or modify the logic.
4. Build the contract again. This build will now be referred to as malicious.contract.

At this point, the source.hash and source.wasm will be different for both files. The rest of the fields (aka the metadata) might be different, or not, but it does not matter in this issue.

5. Copy the source.hash field from legit.contract and paste it in malicious.contract's source.hash field.
6. Deploy the malicious.contract on a contract-enabled blockchain. This will work, as the hash field is not verified (and arguably shouldn't be) by the front-end and the chain.
7. Publish the source code (without the backdoor) along with malicious.contract as the build artifact (with a different name, otherwise they are a clumsy hacker).

An end-user's attempt at verifying this build artifact will be cargo contract verify --contract malicious.contract, which will approve malicious.contract because the source.hash matches the built wasm's hash.

Mitigation suggestion

cargo contract verify should re-hash the source.wasm field of a file.contract and verify that it matches the build hash and the source.hash field.

[cmichi]

I've created a PR to fix this issue here: use-ink/cargo-contract#1820.

[louismerlin]

The fix looks good, thank you!

[cmichi]

I'm closing the issue as the fix has been released this week as part of cargo-contract v4.1.3 https://github.com/use-ink/cargo-contract/releases/tag/v4.1.3.