Title
Unfiltered Downstream Revert Data Propagation in execute(bytes,bytes[])
Severity
Low / Informational (Gas griefing & integrator reliability risk)
Affected Component
Universal / Infinity Router
Function: execute(bytes commands, bytes[] inputs)
Summary
The router’s execute function propagates downstream call reverts without filtering, truncation, or normalization. When a nested call fails, the full revert payload—including arbitrarily large nested data—is bubbled up to the caller. This behavior is deterministic and reproducible and can result in excessive gas consumption, opaque error handling, and fragile integration behavior for callers relying on revert decoding.
Impact
Potential gas griefing via large revert payloads
Poor error hygiene for integrators parsing revert data
Reduced debuggability due to nested, opaque revert structures
No direct loss of funds was observed.
Proof of Concept
Fuzzing identified deterministic reverts with stable selectors and large nested payloads
Exact calldata (~1.4 KB) was replayed against a local Anvil fork using Foundry
Reverts reproduced consistently across runs
Behavior confirmed to originate from downstream calls, not tooling
Example observed selectors include wrapped / bubbled revert data rather than canonical errors.
Root Cause
The router does not sanitize or cap revert data returned from downstream calls before bubbling it up to the caller.
Recommendation
Consider normalizing revert behavior by:
Truncating revert payloads beyond a safe size, or
Wrapping downstream reverts in a standardized error type
Notes
This behavior was validated using Foundry and Anvil; tooling accurately reflected on-chain execution and is not implicated.
Title
Unfiltered Downstream Revert Data Propagation in execute(bytes,bytes[])
Severity
Low / Informational (Gas griefing & integrator reliability risk)
Affected Component
Universal / Infinity Router
Function: execute(bytes commands, bytes[] inputs)
Summary
The router’s execute function propagates downstream call reverts without filtering, truncation, or normalization. When a nested call fails, the full revert payload—including arbitrarily large nested data—is bubbled up to the caller. This behavior is deterministic and reproducible and can result in excessive gas consumption, opaque error handling, and fragile integration behavior for callers relying on revert decoding.
Impact
Potential gas griefing via large revert payloads
Poor error hygiene for integrators parsing revert data
Reduced debuggability due to nested, opaque revert structures
No direct loss of funds was observed.
Proof of Concept
Fuzzing identified deterministic reverts with stable selectors and large nested payloads
Exact calldata (~1.4 KB) was replayed against a local Anvil fork using Foundry
Reverts reproduced consistently across runs
Behavior confirmed to originate from downstream calls, not tooling
Example observed selectors include wrapped / bubbled revert data rather than canonical errors.
Root Cause
The router does not sanitize or cap revert data returned from downstream calls before bubbling it up to the caller.
Recommendation
Consider normalizing revert behavior by:
Truncating revert payloads beyond a safe size, or
Wrapping downstream reverts in a standardized error type
Notes
This behavior was validated using Foundry and Anvil; tooling accurately reflected on-chain execution and is not implicated.