# Incorrect implementation of RecordParser.readKeyValue()

ENS RecordParser.readKeyValue returns value past the requested range when no space terminator exists, corrupting parsed DNS record key-values.

- Payout: Audit contest
- Severity: medium
- Program: ENS
- Found by: hihen
- Disclosed: 2023-08-31
- Write-up quality: 6/10
- Original: https://code4rena.com/reports/2023-04-ens#m-04
- Library page: https://bugbountylibrary.com/r/c4%3A2023-04-ens%3AM-04
- Tags: area:web3 domain:web3 impact:integrity kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:accounting-error

**Target:** Solidity library RecordParser.readKeyValue in dnsregistrar
**Root cause:** When the space terminator is not found within the queried range, terminator is set to input.length instead of offset+len, so value and nextOffset extend beyond the requested slice.
**Steps:**
1. Call `RecordParser.readKeyValue(input, offset, len)` where no space exists in `(separator+1)..(offset+len)`.
2. Observe terminator falls back to `input.length` (RecordParser.sol#L34).
3. Result: value includes trailing data beyond offset+len and nextOffset = input.length+1.
4. Repro: parse `usdt;issuer=tether decimals=18;https://tether.to` with kvCount=2; values[1] returns `18;https://tether.to` instead of `18`.
**How found:** Code review of the readKeyValue range logic: noticed the fallback terminator uses input.length rather than the caller-supplied offset+len bound, violating the documented read range.
**Insight:** When auditing parsing libraries, check that fallback/not-found branches respect the caller-supplied length bound, not the whole buffer length; off-by-range fallbacks silently leak trailing bytes into parsed fields.