Anchor IDL parser panic on malformed generic type strings (DoS)
Repo: https://github.com/solana-foundation/anchor
Component: anchor-lang-idl-spec (IDL type-string parser)
Fixed by: https://github.com/yukikm/anchor/commit/d5fd3eb4d7cc9c8d3e4b0f5aeb2c28d5bb1b1b43
(branch: fix-idl-defined-generics-parser-dos)
Summary
IdlType::from_str could panic when parsing malformed “defined type” strings with generics, due to unwrap() calls on missing slices / missing closing >.
This is a denial-of-service class issue for any tooling that parses IDLs or type strings and treats panics as fatal (e.g., build tooling / codegen / CI pipelines). A malicious or corrupted IDL/type string could crash the process instead of returning a structured error.
Impact
- Availability risk: a single malformed type string can crash the parser process.
- Developer tooling / CI disruption: panics terminate the entire build/codegen run rather than returning a useful error.
No on-chain funds are directly at risk (this is off-chain tooling), but it can be used to break build pipelines or automated IDL ingestion.
Affected code
In idl/spec/src/lib.rs, within impl FromStr for IdlType, the “Defined” branch parsed generics like:
Why it panicked
strip_suffix('>').unwrap()panics if the string is missing the closing>.- Example:
"MyStruct<Pubkey"
- Example:
- Empty-generic cases (e.g.
"MyStruct<>") also flowed intosplit(',')and could lead to confusing behavior; the fix makes this an explicit error.
Proof of concept / reproduction
Run this snippet against the vulnerable version:
Expected behavior
Return Err(...) describing invalid generic syntax.
Actual behavior (pre-fix)
Process panics (DoS).
Fix
The fix replaces unwrap() calls with error-returning parsing:
- If the closing
>is missing → returnErr(anyhow!(...)) - If the generic list is empty or contains empty items → return
Err(anyhow!(...))
Commit: d5fd3eb
Diff: https://github.com/yukikm/anchor/commit/d5fd3eb4d7cc9c8d3e4b0f5aeb2c28d5bb1b1b43
Verification
New tests were added to ensure malformed inputs return Err and do not panic:
IdlType::from_str("MyStruct<Pubkey")→ErrIdlType::from_str("MyStruct<>")→Err
To verify locally:
PR
Create PR from fork branch:
Notes
- This is consistent with prior hardening in the same parser where malformed array types were changed from panics to structured errors.
- The approach is intentionally minimal-scope: it only changes malformed generic parsing to return errors rather than panicking.