Zaros Part 1
Zaros
DeFiFoundry
60,000 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

Missing Boundary Checks in the liquidateAccounts function

Caesar

Relevant GitHub Links

https://github.com/Cyfrin/2024-07-zaros/blob/main/src/perpetuals/branches/LiquidationBranch.sol#L105-L223

Summary

Lack of boundary checks in liquidateAccounts can lead to unintended behavior by processing invalid or non-existent accounts.

Vulnerability Details

The function does not verify if the account IDs in accountsIds are valid or if the accounts exist. This oversight can lead to unintended behavior, such as processing invalid accounts or encountering errors during execution.

Impact

Unintended Behavior: Processing invalid or non-existent accounts can lead to errors or unexpected results.

Operational Issues: Lack of validation might cause the function to behave unpredictably.

Tools Used

Manual

Recommendations

Add Boundary Checks: Ensure that the account IDs are within valid bounds and that the accounts exist before processing.

+ if (ctx.tradingAccountId == 0 || !tradingAccount.exists(ctx.tradingAccountId)) {
+ continue;
+ }
Updates

Lead Judging Commences

inallhonesty Lead Judge about 1 year ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.