🐞 Fix Base58 decodeWord (#1545)

* 🐞 Fix Base58 `decodeWord` sanitizer ordering (#1544)

* Added TestCase

---------

Co-authored-by: 0x1220c <cristianizzo@me.com>

Author: atarpara

src/utils/Base58.sol

@@ -189,10 +189,15 @@ library Base58 {
 
             for { let j := 0 } 1 {} {
                 let c := sub(byte(0, mload(add(s, j))), 49)
+                // Check if the input character is valid.
+                if iszero(and(shl(c, 1), 0x3fff7ff03ffbeff01ff)) {
+                    mstore(0x00, 0xe8fad793) // `Base58DecodingError()`.
+                    revert(0x1c, 0x04)
+                }
                 let p := mul(result, 58)
                 let acc := add(byte(0, mload(c)), p)
-                // Check if the input character is valid.
-                if iszero(and(0x3fff7ff03ffbeff01ff, shl(c, lt(lt(acc, p), lt(result, t))))) {
+                // Check for multiplication or addition overflow.
+                if iszero(lt(lt(acc, p), lt(result, t))) {
                     mstore(0x00, 0xe8fad793) // `Base58DecodingError()`.
                     revert(0x1c, 0x04)
                 }

test/Base58.t.sol

@@ -259,6 +259,43 @@ contract Base58Test is SoladyTest {
         this.decodeWord("JEKNVnkbo3jma5nREBBJCDoXFVeKkD56V3xKrvRmWxFH@");
     }
 
+    function testDecodeWordLowCharacterReverts() public {
+        // 0 - 48 (before '1')
+        for (uint256 i = 0; i < 48; i++) {
+            vm.expectRevert(Base58.Base58DecodingError.selector);
+            this.decodeWord(LibString.toHexString(i));
+        }
+        // 58 - 64 (: ; < = > ? @)
+        for (uint256 i = 58; i <= 64; ++i) {
+            vm.expectRevert(Base58.Base58DecodingError.selector);
+            this.decodeWord(LibString.toHexString(i));
+        }
+        vm.expectRevert(Base58.Base58DecodingError.selector);
+        this.decodeWord("I");
+        vm.expectRevert(Base58.Base58DecodingError.selector);
+        this.decodeWord("O");
+        // 91 - 96 ([ \ ] ^ _ `)
+        for (uint256 i = 91; i <= 96; ++i) {
+            vm.expectRevert(Base58.Base58DecodingError.selector);
+            this.decodeWord(LibString.toHexString(i));
+        }
+        vm.expectRevert(Base58.Base58DecodingError.selector);
+        this.decodeWord("l");
+
+        // 123 - 127 ({ | } ~ DEL)
+        for (uint256 i = 123; i <= 255; ++i) {
+            vm.expectRevert(Base58.Base58DecodingError.selector);
+            this.decodeWord(LibString.toHexString(i));
+        }
+        vm.expectRevert(Base58.Base58DecodingError.selector);
+        this.decodeWord("\x00");
+
+        // Also cover an underflowing byte after a valid character, where
+        // `result` is already nonzero (loop position > 0).
+        vm.expectRevert(Base58.Base58DecodingError.selector);
+        this.decodeWord("z0");
+    }
+
     function decodeWord(string memory encoded) public pure returns (bytes32) {
         return Base58.decodeWord(encoded);
     }