stake.link

Summary

The getLockIdsByOwner function has been audited for potential vulnerabilities and security concerns. The function is designed to retrieve lock IDs associated with a specific owner address. The audit identified a potential issue related to address validation and an assert statement within the function.

Vulnerability Details

Lack of Address Validation

The function does not validate the _owner address parameter, which could result in unexpected behavior if the zero address is passed. This lack of validation can be exploited, as passing the zero address may manipulate the assert check inside the function.

The assert statement assert(lockIdsFound == lockCount); may be manipulated when the zero address is provided as the owner. In such cases, both lockIdsFound and lockCount will be zero, causing the assert statement to pass, potentially leading to unintended consequences.

Impact

The impact of these vulnerabilities is significant. An attacker could exploit the lack of address validation to pass the zero address as the owner, manipulating the assert statement and potentially causing unexpected behavior in the contract.

POC

• Copy the below function

• Run the test via forge test --match-test testGetLockIdsByOwner -vvv

• You will get the below results

Results:

Test code:

Tools Used

Manual code review.

Recommendations

Address Validation:

• Implement address validation within the getLockIdsByOwner function to ensure that the provided address is not the zero address and is a valid Ethereum address.