Submission Details
Severity:
`viewWhitelistedCurrencies` missing important check for `cursor` which can lead to unintentional behavior
Summary
viewWhitelistedCurrencies missing important checks for cursor which can lead to unintentional behavior
Vulnerability Details
Here you can see the cursor is not checking whether it is in the correct length.
/**
* @notice See whitelisted currencies in the system
* @param cursor cursor (should start at 0 for first request)
* @param size size of the response (e.g., 50)
*/
function viewWhitelistedCurrencies(
uint256 cursor,
uint256 size
) external view override returns (address[] memory, uint256) {
uint256 length = size;
if (length > _whitelistedCurrencies.length() - cursor) {
length = _whitelistedCurrencies.length() - cursor;
}
address[] memory whitelistedCurrencies = new address[]();
for (uint256 i = 0; i < length; i++) {
whitelistedCurrencies[i] = _whitelistedCurrencies.at(cursor + i);
}
return (whitelistedCurrencies, cursor + length);
}
Impact
Passing greater or equal value to _whitelistedCurrencies.length() can lead to unintentional behavior
Tools Used
Manually Reviewed
Recommendations
Add the following lines of code here.
/**
* @notice See whitelisted currencies in the system
* @param cursor cursor (should start at 0 for first request)
* @param size size of the response (e.g., 50)
*/
function viewWhitelistedCurrencies(
uint256 cursor,
uint256 size
) external view override returns (address[] memory, uint256) {
+ if (cursor >= _whitelistedCurrencies.length()) {
+ revert("Invalid cursor value");
+ }
uint256 length = size;
if (length > _whitelistedCurrencies.length() - cursor) {
length = _whitelistedCurrencies.length() - cursor;
}
address[] memory whitelistedCurrencies = new address[]();
for (uint256 i = 0; i < length; i++) {
whitelistedCurrencies[i] = _whitelistedCurrencies.at(cursor + i);
}
return (whitelistedCurrencies, cursor + length);
}
Prize pool breakdown
Total prize
15,000 USDC
nSLOC
54128 USDC / LOC
14,000 USDC
1,000 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.