Submission Details
Severity:
Invalid Route Number Access in router.exchange
Vulnerability Details
The function does not validate _routeNumber before accessing the mappings routes, swapParams, and pools. If _routeNumber > nRoutes, the mappings will return default values, such as address(0) for addresses and 0 for integers, potentially leading to an invalid transaction.
Impact
Passing invalid parameters to router.exchange can cause the transaction to revert or execute with unintended behavior, leading to wasted gas or protocol disruption.
Proof of Concept
router.exchange(
routes[_routeNumber], // Could return address(0)
swapParams[_routeNumber], // Could return default 0 values
_amountClaim, _minOut, pools[_routeNumber], // Could return address(0)
address(this)
);
Tools Used
Manual code review.
Recommended Mitigation Steps
Add a validation check to ensure _routeNumber is within the valid range:
require(_routeNumber < nRoutes, "Invalid route number");
Prize pool breakdown
Total prize
16,653 OP
nSLOC
25366
OP / LOC
15,800
853
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.