Submission Details
Severity:
The input arrays in `ConstantProduct2::calcReserveAtRatioLiquidity` are never checked
Summary
The input arrays in ConstantProduct2::calcReserveAtRatioLiquidity are never checked. This can can lead to weird situation.
Vulnerability Details
The input arrays are never checked. If the reserves.length != ratios.length != 2 then the whole uint256 i = j == 1 ? 0 : 1; can have unexpected results.
Impact
Impact is high because these numbers are a central piece of the constant product calculation.
Likelihood is extremely low.
Overall the impact is low.
Tools Used
Manual review
Recommendations
Perform the following changes:
function calcReserveAtRatioLiquidity(
uint256[] calldata reserves,
uint256 j,
uint256[] calldata ratios,
bytes calldata
) external pure override returns (uint256 reserve) {
++ require(reserves.length == 2 && ratios.length == 2, "Invalid arrays");
uint256 i = j == 1 ? 0 : 1;
reserve = reserves[i] * ratios[j] / ratios[i];
}
Updates
Lead Judging Commences
giovannidisiena about 1 year ago
Submission Judgement Published Reason: Design choice
Assigned finding tags:
Informational/Invalid
Prize pool breakdown
Total prize
12,000 USDC
nSLOC
47925 USDC / LOC
10,000 USDC
1,000 USDC
1,000 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.