# Potential damages due to incorrect implementation of the ````ZIP```` algorithm

WooracleV2_2 fallback ZIP decoder lacks a reserved selector prefix, so zipped price data can collide with real function selectors and trigger unintended calls.

- Payout: Contest reward
- Severity: medium
- Program: Woofi Swap
- Credited: KingNFT
- Disclosed: 2024-03-06
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2024-03-woofi-swap-judging/issues/13
- Library page: https://bugbountylibrary.com/r/sherlock%3A2024-03-woofi-swap%3AM-1
- Tags: domain:web3 impact:integrity kind:contest platform:sherlock sev:medium tech:evm tech:solidity technique:source-review vuln:access-control vuln:business-logic

**Target:** WooracleV2_2 oracle fallback ZIP calldata decoder
**Root cause:** The fallback(bytes) ZIP decoder treats msg.data starting at byte 0 as zipped payload, but Solidity routes any calldata whose first 4 bytes match a real selector to that function instead of fallback, so ZIP blobs can be misrouted.
**Steps:**
1. Craft ZIP blob where bytes 1-4 equal a target selector, e.g. `0x715018a6` for renounceOwnership()
2. Send blob via `address(oracle).call(zip)`
3. Solidity dispatches to renounceOwnership() instead of fallback, zeroing owner
4. Repeat with `0x99235fd4` setStaleDuration, `0xd5bade07` postPrice, `0x4f1f1999` syncTS to corrupt state/price/timestamp
**How found:** Read Solidity fallback(bytes) docs noting _input equals msg.data, realized compiler selector dispatch precedes fallback, then brute-forced ZIP payloads whose leading bytes match real selectors and wrote Foundry PoCs.
**Exploitation:** Off-chain price-posting script submits zipped calldata; if the first 4 bytes happen to match a contract selector, the call executes that function with attacker-unintended args, e.g. renounceOwnership() or postPrice() with garbage, corrupting oracle state or silently failing price updates.
**Insight:** When a contract decodes raw msg.data in fallback(bytes), remember the compiler still routes matching 4-byte selectors to real functions first; reserve a non-colliding prefix (e.g. 0x00000000) and offset the payload.