Project
One World
NFTDeFi
15,000 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

Invariant violation of the `EnumerableSet::at` method in the `CurrencyManager::viewWhitelistedCurrencies` function.

0xrolko

Relevant GitHub Links

https://github.com/Cyfrin/2024-11-one-world/blob/1e872c7ab393c380010a507398d4b4caca1ae32b/contracts/dao/CurrencyManager.sol#L99

Summary

Lack of check the index before passing it to the EnumerableSet::at method.

Vulnerability Details

When we use the EnumerableSet::at method to retrieve an element at a certain position in the array given an index, we must respect this requirement: index must be strictly less than {length}. as we can see on its Github repo: https://github.com/OpenZeppelin/openzeppelin-contracts/blob/49c0e4370d0cc50ea6090709e3835a3091e33ee2/contracts/utils/structs/EnumerableSet.sol#L139C11-L139C54

In the CurrencyManager::viewWhitelistedCurrencies function we use this EnumerableSet::at method but the above requirement has not been implemented:

function viewWhitelistedCurrencies(
uint256 cursor,
uint256 size
) external view override returns (address[] memory, uint256) {
/// ... The rest of code
​
for (uint256 i = 0; i < length; i++) {
// @audit lack of index check
@> whitelistedCurrencies[i] = _whitelistedCurrencies.at(cursor + i);
}
​
return (whitelistedCurrencies, cursor + length);
}

Impact

Unexpected behaviour and out-of-Bounds Access.

Tools Used

Manual review.

Recommendations

function viewWhitelistedCurrencies(
uint256 cursor,
uint256 size
) external view override returns (address[] memory, uint256) {
/// ... The rest of code
​
for (uint256 i = 0; i < length; i++) {
+ require(cursor + i < _whitelistedCurrencies.lenth, "Index out of bound");
whitelistedCurrencies[i] = _whitelistedCurrencies.at(cursor + i);
}
​
return (whitelistedCurrencies, cursor + length);
}
Updates

Lead Judging Commences

0xbrivan2 Lead Judge 10 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.