Resources
People often ask me "How did you learn how to hack?" The answer: by reading. This page is a collection of the blog posts and other articles that I have accumulated over the years of my journey. Enjoy!
- ENS stores domains. Once it's been registered, there is a metadata service that is offchain and written in JS/TS.
- This is done with the following steps:
- Register the name
- Emit an event of
NameRegistered - The ENS metadata service
- The metadata service passes the event info to Subgraph.
- When the JS/TS is parsing the string, it sees
0x00has a nullbyte and terminates the string. By registering a name with a nullbyte at the end, it won't be a duplicate but it can be an arbitrary string in subgraph! - This is a pretty neat vulnerability! The combining of systems creating terrible and unexpected vulnerabilities.
