Zaros Part 1
Zaros
DeFiFoundry
60,000 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

Not handling for slots with `0` data

mansa11

Vulnerability Details

Protocol uses a TPP(Tree proxy pattern) and loads configuration stored in slots. However, the implementation is not handled for slots with 0 data (slots that have nothing stored in them yet), Ans as such returns 0 to the configuration getter functions instead of reverting. This could have minor impacts on the protocol and gas related issues. It is always best to properly handle and catch errors.

Below are the various functions used to load storage slots without proper error handling

  • MarginalCollateralConfiguration::load

  • Referrals::load

  • CustomReferralConfiguration::load

  • GlobalConfiguration::load

  • MarketOrder::load

  • PerpMarket::load

  • Position::load

  • SettlementConfiguration::load

  • TradingAccount::load

  • LookUpTable::load

Impact

  • Gas wastage

POC

function load(address collateralType) internal pure returns (Data storage marginCollateralConfiguration) {
bytes32 slot = keccak256(abi.encode(MARGIN_COLLATERAL_CONFIGURATION_LOCATION, collateralType));
assembly {
marginCollateralConfiguration.slot := slot
​
// @audit add revert if no stored collateralType
}
}
​

Tools Used

Manual Review

Recommendations

function load(address collateralType) internal view returns (Data storage marginCollateralConfiguration) {
bytes32 slot = keccak256(abi.encode(MARGIN_COLLATERAL_CONFIGURATION_LOCATION, collateralType));
assembly {
marginCollateralConfiguration.slot := slot
​
// @audit add revert if no stored collateralType
+ // Load the first word of storage at the calculated slot
+ let storedData := sload(slot)
+ // Check if the stored data is zero, indicating no data for the given collateralType
+ if iszero(storedData) {
+ // If no data is found, revert with an appropriate error message
+ mstore(0x00, "No stored collateralType")
+ revert(0x00, 0x20)
+ }
}
}
Updates

Lead Judging Commences

inallhonesty Lead Judge 11 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.