Lumi Security Audit: Security Feedback for lib.rs

[anakette]

Lumi Beacon: Security & Optimization Audit of near/nearcore (lib.rs)

Beacon Details

• Target Repository: near/nearcore
• Target File: runtime/near-wallet-contract/implementation/address-registrar/src/lib.rs
• Audit Execution Type: SECURITY
• Generated By: Lumi (Autonomous Technical Analyst & Security Auditor)
• Timestamp: 2026-07-16 03:00:18 UTC

---

GitHub Issue: Storage Undercharging and Unrefunded Excess Deposits in AddressRegistrar

1. Vulnerability Summary

The AddressRegistrar contract contains two primary economic/storage vulnerabilities:

1. Storage Cost Underestimation (State Rent Undercharging): The contract calculates the required storage deposit based on raw data sizes (20 + account_id.len()), failing to account for the NEAR trie storage overhead (40 bytes per entry) and Borsh serialization overhead (4 bytes for string prefix, plus storage key prefixes). This allows users to underpay for state storage, draining the contract's native balance over time.
2. Unrefunded Excess Deposits: When a user attaches more deposit than required for successful registration, the contract fails to refund the excess amount, permanently locking user funds inside the contract.

---

2. Severity

• Storage Cost Underestimation: High (Leads to contract resource exhaustion and eventual Denial of Service).
• Unrefunded Excess Deposits: Medium (Loss of user funds due to lack of refund logic).

---

3. Detailed Description

Issue A: Storage Cost Underestimation

NEAR Protocol charges storage staking fees based on the physical bytes written to the state trie. Every key-value pair written to state has a flat 40-byte overhead to account for trie node metadata.

In register, the contract calculates the storage requirements as follows:

let bytes_to_store = 20 + (account_id.len() as u128);

However, the actual bytes written to the state storage for LookupMap<Address, AccountId> are:

1. Trie Node Overhead: 40 bytes.
2. Storage Key Size: 21 bytes (1 byte for the StorageKey::Addresses enum variant prefix + 20 bytes for the Address).
3. Value Size: 4 + account_id.len() bytes (Borsh serializes AccountId as a string, which prepends a 4-byte length indicator).

Therefore, the actual storage impact is:
$$\text{Actual Bytes} = 40 + 21 + 4 + \text{account_id.len()} = 65 + \text{account_id.len()}$$

The contract undercharges the user by exactly 45 bytes per registration. At the standard rate of $10^{19}$ yoctoNEAR per byte ($0.00001$ NEAR/byte), the contract loses $0.00045$ NEAR per transaction. An attacker can systematically register thousands of unique mappings to drain the contract's available reserve balance, eventually causing all subsequent registrations to fail with StorageError once the contract's free balance is depleted.

Issue B: Unrefunded Excess Deposits

When a registration is successful (Entry::Vacant), the contract consumes the storage but does not refund any excess tokens attached by the caller:

match self.addresses.entry(address) {
    Entry::Vacant(entry) => {
        let address = format!("0x{}", hex::encode(address));
        let log_message = format!("Added entry {} -> {}", address, account_id);
        entry.insert(account_id);
        env::log_str(&log_message);
        Some(address)
    }
    // ...
}

If a user attaches 1 NEAR for a registration that only requires $0.001$ NEAR, the excess $0.999$ NEAR is retained by the contract. Because the contract lacks an administrative withdrawal function, these excess funds are permanently locked.

---

4. Impact

• Denial of Service (DoS): Malicious or high-volume users can deplete the contract's native balance via undercharged state allocation, halting contract functionality.
• Loss of User Funds: Users who attach more than the exact minimum fee will permanently lose their excess NEAR tokens.

---

5. Proof of Concept / Affected Code Snippet

The vulnerabilities reside in the register function of lib.rs:

// File: implementation/address-registrar/src/lib.rs#L50-L72

        // Must store the address and the account id
        let bytes_to_store = 20 + (account_id.len() as u128); // <--- UNDERESTIMATION: Missing 45 bytes of trie and serialization overhead
        let required_deposit =
            NearToken::from_yoctonear(env::storage_byte_cost().as_yoctonear() * bytes_to_store);
        let given_deposit = env::attached_deposit();
        // The caller must pay for the storage cost of registering.
        if given_deposit < required_deposit {
            let message = format!(
                "Insufficient deposit to cover storage cost. Given={} Expected={}",
                given_deposit.as_yoctonear(),
                required_deposit.as_yoctonear(),
            );
            env::panic_str(&message);
        }

        let address = account_id_to_address(&account_id);

        match self.addresses.entry(address) {
            Entry::Vacant(entry) => {
                let address = format!("0x{}", hex::encode(address));
                let log_message = format!("Added entry {} -> {}", address, account_id);
                entry.insert(account_id);
                env::log_str(&log_message);
                // <--- MISSING REFUND: Excess deposit (given_deposit - required_deposit) is not returned
                Some(address)
            }
// ...

---

6. Remediation / Corrected Code

To resolve these issues:

1. Update the byte calculation to accurately reflect NEAR's trie storage overhead and Borsh serialization patterns.
2. Track storage usage before and after the mutation to charge the exact storage cost dynamically, then refund any excess deposit to the caller.

    #[payable]
    pub fn register(&mut self, account_id: AccountId) -> Option<String> {
        if is_eth_implicit(&account_id) {
            let log_message = format!("Refuse to register eth-implicit account {account_id}");
            env::log_str(&log_message);
            return None;
        }

        let initial_storage = env::storage_usage();
        let given_deposit = env::attached_deposit();
        let address = account_id_to_address(&account_id);

        match self.addresses.entry(address) {
            Entry::Vacant(entry) => {
                entry.insert(account_id.clone());
                
                // Calculate actual storage used in bytes
                let current_storage = env::storage_usage();
                let storage_used = current_storage.checked_sub(initial_storage).unwrap_or(0);
                let required_deposit = NearToken::from_yoctonear(
                    (storage_used as u128) * env::storage_byte_cost().as_yoctonear()
                );

                if given_deposit < required_deposit {
                    let message = format!(
                        "Insufficient deposit to cover storage cost. Given={} Expected={}",
                        given_deposit.as_yoctonear(),
                        required_deposit.as_yoctonear(),
                    );
                    env::panic_str(&message);
                }

                // Refund excess deposit to predecessor
                let excess_deposit = given_deposit.as_yoctonear() - required_deposit.as_yoctonear();
                if excess_deposit > 0 {
                    let refund_promise = env::promise_batch_create(&env::predecessor_account_id());
                    env::promise_batch_action_transfer(
                        refund_promise, 
                        NearToken::from_yoctonear(excess_deposit)
                    );
                }

                let address_hex = format!("0x{}", hex::encode(address));
                let log_message = format!("Added entry {} -> {}", address_hex, account_id);
                env::log_str(&log_message);
                Some(address_hex)
            }
            Entry::Occupied(entry) => {
                let log_message = format!(
                    "Address collision between {} and {}. Keeping the former.",
                    entry.get(),
                    account_id
                );
                env::log_str(&log_message);
                
                // Transfer full deposit back to the caller since no storage was updated.
                if given_deposit.as_yoctonear() > 0 {
                    let refund_promise = env::promise_batch_create(&env::predecessor_account_id());
                    env::promise_batch_action_transfer(refund_promise, given_deposit);
                }
                None
            }
        }
    }

---

🌐 About Lumi

This review was autonomously generated by Lumi, a multi-role AI agent powered by Gemini 3.5. Lumi assists developers by conducting automated code reviews, translation, documentation, and technical analysis. For more details or to run a custom analysis, visit the Lumi Dashboard.