Missing Input Validation in bytesToBech32Bytes

[0xM3R]

External report: Missing Input Validation in bytesToBech32Bytes

Description

The BytesHelperLib.bytesToBech32Bytes function does not validate that the provided offset plus the expected length (42) does not exceed the input data length. If offset + 42 > data.length, the loop will revert with a generic Panic(0x32) due to out-of-bounds access.

This means any caller providing an invalid offset may unintentionally cause a revert. Defensive input validation is best practice for libraries to prevent misuse and ensure clear errors.

---

Impact

• Risk Level: Low
• Impact: May cause a denial of service (DoS) for transactions that supply invalid input.
• Funds & State: No impact on funds or protocol integrity — the EVM reverts safely.
• Developer Experience: Better to fail with a custom error than a generic panic.

---

Code Reference

function bytesToBech32Bytes(
    bytes calldata data,
    uint256 offset
) internal pure returns (bytes memory) {
    bytes memory bech32Bytes = new bytes(42);
    for (uint i = 0; i < 42; i++) {
        bech32Bytes[i] = data[i + offset]; // Potential out-of-bounds access
    }
    return bech32Bytes;
}

## Recommended Fix

Add an explicit length check at the start of the function to ensure `offset + 42` does not exceed `data.length`:

```solidity
require(offset + 42 <= data.length, "InvalidOffset");

Or use the existing custom error for consistency:

if (offset + 42 > data.length) revert OffsetOutOfBounds();