Submission Details
Severity:
Consider Adding Input Validation for Route Parameters
Summary
The addRoute function accepts route parameters without validation. While protected by onlyManagement and Curve Router's own checks, adding basic validation could improve error reporting and management UX.
Vulnerability Details
function addRoute(
address[11] calldata _route,
uint256[5][5] calldata _swapParams,
address[5] calldata _pools
) external onlyManagement {
routes[nRoutes] = _route;
swapParams[nRoutes] = _swapParams;
pools[nRoutes] = _pools;
nRoutes++;
}
Impact
Low/Informational:
Invalid parameters will revert at swap time rather than route addition
Slightly worse UX for management when debugging route issues
Recommendation
function addRoute(
address[11] calldata _route,
uint256[5][5] calldata _swapParams,
address[5] calldata _pools
) external onlyManagement {
// Basic sanity checks for better error messages
require(_route[0] != address(0), "Invalid start token");
require(_pools[0] != address(0), "Invalid pool");
routes[nRoutes] = _route;
swapParams[nRoutes] = _swapParams;
pools[nRoutes] = _pools;
nRoutes++;
}
Prize pool breakdown
Total prize
16,653 OP
nSLOC
25366 OP / LOC
15,800
853
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.