Submission Details
Severity:
Check if token addresses are unique
Vulnerability Details
The list of collateral tokens, s_collateralTokens, is determined when the contract is constructed. The lack of duplicate check could cause getAccountCollateralValue to calculate collateral value inaccurately.
For example, when s_collateralTokens includes [A_token, B_token, A_token] and a user has 20 A_token, getAccountCollateralValue returns the USD value of 40 A_token as collateral value of the user.
Impact
A malicious user could amplify the total value of assets if users does not check the duplicate.
Tools Used
manual
Recommendations
In constructor of DSCEngine
for (uint256 i = 0; i < tokenAddresses.length; i++) {
+ if (s_priceFeeds[tokenAddresses[i]] != address(0)) revert error();
s_priceFeeds[tokenAddresses[i]] = priceFeedAddresses[i];
s_collateralTokens.push(tokenAddresses[i]);
}
Prize pool breakdown
Total prize
15,000 USDC
nSLOC
23664 USDC / LOC
14,000 USDC
1,000 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.