Project
One World
NFTDeFi
15,000 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

Missing input validation in `CurrencyManager::viewWhitelistedCurrencies` causing a loss of the user fees

4th05

Relevant GitHub Links

https://github.com/Cyfrin/2024-11-one-world/blob/main/contracts/dao/CurrencyManager.sol#L86-L103

Summary

A missing input validation of one of the parameters CurrencyManager::viewWhitelistedCurrencies may lead to useless transaction without giving error ending in a loss of the paid fee

Vulnerability Details

There is not input validation of the size parameter in the CurrencyManager::viewWhitelistedCurrencies function to check is always verified the following condition: size>0

function viewWhitelistedCurrencies(
uint256 cursor,
uint256 size
) external view override returns (address[] memory, uint256) {
uint256 length = size;
​
if (length > _whitelistedCurrencies.length() - cursor) {
length = _whitelistedCurrencies.length() - cursor;
}
​
address[] memory whitelistedCurrencies = new address[]();
​
for (uint256 i = 0; i < length; i++) {
whitelistedCurrencies[i] = _whitelistedCurrencies.at(cursor + i);
}
​
return (whitelistedCurrencies, cursor + length);
}

Impact

Users can use the external function by submitting a valid parameter (with no error given to the user), that does not return them anything resulting in the loss of all the transaction fees

Tools Used

Manual review

Recommendations

function viewWhitelistedCurrencies(
uint256 cursor,
uint256 size
) external view override returns (address[] memory, uint256) {
+ require (size>0, "invalid size");
uint256 length = size;
​
if (length > _whitelistedCurrencies.length() - cursor) {
length = _whitelistedCurrencies.length() - cursor;
}
​
address[] memory whitelistedCurrencies = new address[]();
​
for (uint256 i = 0; i < length; i++) {
whitelistedCurrencies[i] = _whitelistedCurrencies.at(cursor + i);
}
​
return (whitelistedCurrencies, cursor + length);
}
Updates

Lead Judging Commences

0xbrivan2 Lead Judge 10 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.