Summary

The deployer may unintentionally pass duplicate collateral token addresses in tokenAddresses and price feed addresses in priceFeedAddresses. This could potentially result in a significant deviation in the total collateral value for users.

Vulnerability Details

1. There is no uniqueness check for duplicate tokenAddresses and priceFeedAddresses in the constructor.

2. Therefore, the deployer may have passed the same stablecoin address in tokenAddresses along with the corresponding price feed address in priceFeedAddresses during deployment.

3. This situation will cause a significant deviation when users call getAccountCollateralValue() to retrieve their total collateral value, as the duplicated collateral token addresses are included in the calculation.

As shown in the figure:

Tools Used

• Manual Review

impact

• The significant deviation in the total collateral value will directly impact the calculation of the health factor, which in turn affects the number of coins that users can mint.

Recommendations

• In the constructor, it is important to perform a uniqueness check for tokenAddresses and priceFeedAddresses. This will ensure that duplicate collateral token addresses and price feed addresses cannot be used.