Zaros Part 1

Relevant Link

• https://github.com/Cyfrin/2024-07-zaros/blob/d687fe96bb7ace8652778797052a38763fbcbb1b/src/perpetuals/branches/GlobalConfigurationBranch.sol#L143

Summary

The GlobalConfigurationBranch:getAccountsWithActivePositions function lacks proper validation for the upperBound parameter, potentially leading to out-of-bounds errors. This vulnerability could result in incorrect data retrieval and potential disruption of the system's operations.

Vulnerability Details

The getAccountsWithActivePositions function retrieves a list of accounts with active positions between specified lower and upper bounds. However, it does not validate if the upperBound parameter is within the size of the accountsIdsWithActivePositions set. This can lead to out-of-bounds errors, causing the function to revert or return incorrect data.

See the following code:

Impact

This vulnerability can cause the following issues:

• Out-of-Bounds Error: The function may revert, causing disruptions in the system's operations.

• Incorrect Data Retrieval: The function may return incorrect data, affecting the accuracy and reliability of the system.

Tools Used

Manual Review

Recommendations

To mitigate this vulnerability, validate the upperBound parameter to ensure it is within the size of the accountsIdsWithActivePositions set before proceeding with data retrieval.