# Taiko SGX Attestation - Improper validation in certchain decoding

Faulty boolean logic in PEMCertChainLib lets an SGX attestor supply any notBefore tag, bypassing certificate validity-period format validation in Taiko's SGX attestation.

- Payout: Contest reward
- Severity: medium
- Program: Taiko
- Credited: zzebra83
- Disclosed: 2024-04-26
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2024-03-taiko-findings/issues/168
- Library page: https://bugbountylibrary.com/r/c4%3A2024-03-taiko%3AM-13
- Tags: domain:web3 impact:integrity kind:contest platform:code4rena sev:medium tech:solidity technique:source-review vuln:auth-bypass vuln:misconfiguration

**Target:** SGX attestation certchain DER decoder (PEMCertChainLib.sol / SgxVerifier.sol)
**Root cause:** The notBefore tag check `(notBeforeTag != 0x17 && notBeforeTag == 0x18)` is unsatisfiable, so any tag value passes; intended check was `notBeforeTag != 0x17 && notBeforeTag != 0x18`.
**Steps:**
1. Call `registerInstance` in SgxVerifier.sol with a crafted SGX quote whose certchain notBefore field uses an arbitrary tag (e.g. `0x10`) instead of 0x17/0x18.
2. `verifyParsedQuote` reaches Step 4 and calls `pemCertLib.decodeCert` on the cert.
3. In PEMCertChainLib.sol#L135 the notBefore tag condition evaluates false for any tag, so decoding succeeds.
4. Attestation proceeds with an improperly validated certificate validity period.
**How found:** Code-reading of the certchain decode logic; noticed the notBefore condition can never be true (contradictory `!= 0x17 && == 0x18`), unlike the correct notAfter check.
**Insight:** When auditing paired validation checks, compare sibling conditions for asymmetry: a `!=`/`==` mismatch on the same variable is a tell that one branch was mistyped and silently accepts all inputs.