# HexUtils.hexStringToBytes32() and HexUtils.hexToAddress() may return incorrect results

ENS HexUtils hex-to-bytes/address converters silently accept odd, short, or overlong input, reading out-of-range bytes and returning wrong values instead of reverting.

- Payout: Audit contest
- Severity: medium
- Program: ENS
- Found by: hihen
- Disclosed: 2023-08-31
- Write-up quality: 6/10
- Original: https://code4rena.com/reports/2023-04-ens#m-01
- Library page: https://bugbountylibrary.com/r/c4%3A2023-04-ens%3AM-01
- Tags: area:web3 domain:web3 impact:integrity kind:contest platform:code4rena sev:medium tech:solidity technique:source-review vuln:accounting-error

**Target:** HexUtils Solidity library (hexStringToBytes32 / hexToAddress)
**Root cause:** The conversion loops lack length validation: odd length reads an extra out-of-range byte, length >32 discards leading bytes, length <32 zero-pads, all without reverting.
**Steps:**
1. Call `HexUtils.hexStringToBytes32(toUtf8Bytes(hex32Bytes), 0, 63)` with odd length 63; returns valid=true and reads str[63] out of range.
2. Call with idx=1,lastIdx=64 on a 66-char string; reads the half-byte of the extra '00'.
3. Call with idx=0,lastIdx=2; returns a single byte zero-padded to 32 bytes with valid=true.
4. Call with idx=0,lastIdx=68 on a 34-byte string; returns the last 32 bytes, discarding leading data.
5. hexToAddress inherits the same behavior since it calls hexStringToBytes32.
**How found:** Code review of HexUtils conversion loops; noticed missing length checks and wrote Foundry/Hardhat tests for odd, short, and overlong inputs to confirm silent misbehavior.
**Insight:** When auditing hex/byte parsers, test boundary lengths (odd, <N, >N) explicitly: loops that index by pairs often read one byte past lastIdx and silently truncate or pad instead of reverting.