stake.link

Summary

The RewardsInitiator contract containing the performUpkeep function. The review focused on potential vulnerabilities related to array lengths and out-of-bounds array access. A specific concern was identified where the lengths of arrays strategies and strategiesToUpdate were not explicitly checked for mismatches before accessing array indices in a loop.

Vulnerability Details

The performUpkeep function may be susceptible to out-of-bounds array access if the lengths of arrays strategies and strategiesToUpdate do not match. The code lacks a check to ensure that the indices provided in strategiesToUpdate are within the valid range of the strategies array.

Code Snippet:

Impact

If a mismatch in array lengths occurs, the contract may attempt to access out-of-bounds indices in the strategies array, leading to a runtime error and causing the entire transaction to revert. This could result in unexpected behavior when Chainlink automation calls performUpkeep.

POC

Scenario:

• strategies: 2 items.

• strategiesToUpdate: 3 items.

1. First Iteration (i = 0):

   • Check on strategiesToUpdate[0] succeeds as it points to a valid index in strategies.

2. Second Iteration (i = 1):

   • Check on strategiesToUpdate[1] succeeds as it points to a valid index in strategies.

3. Third Iteration (i = 2):

   • Attempt to check strategiesToUpdate[2] fails, as it points to an index outside the valid range of the 2-item strategies array.

Result:

• The third iteration attempts an out-of-bounds access, risking unexpected behavior and potential transaction revert.

Tools Used

Manual code review.

Recommendations

Mismatched Array Length Check: Implement a check to ensure that the lengths of arrays strategies and strategiesToUpdate match before proceeding to the loop. This check should be performed at the beginning of the performUpkeep function.