Liquid Staking
Stakelink
DeFiHardhatOracle
50,000 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

PriorityPool::getAccountIndex returns index 0 for account that doesnt exists leading to a wrong return value for integration and external UIs that queries PriorityPool contracts

0xw3

Summary

PriorityPool::getAccountIndex returns index 0 for account that doesnt exists leading to a wrong return value for integration and external UIs that queries PriorityPool contracts.

Vulnerability Details

This function is not called in project code base and has external visibility so its intended to be called by external project and UIs
However this function returns 0 for accounts that doesnt exists, this could lead to wrong interactions with another contracts or external UIs

function getAccountIndex(address _account) external view returns (uint256) {
return accountIndexes[_account];
}

Impact

Integrity loss between this contract and integration, external UIs because wrong response index

Tools Used

Manual Review

Recommendations

Implement a revert if account not exists in accountIndexes

Updates

Lead Judging Commences

inallhonesty Lead Judge 10 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.