Submission Details
Severity:
Inadequate Access Control for Critical Parameters
The useOracle boolean state variable is declared but never used in the contract, and there's no function to modify it. Additionally, while nRoutes tracks the number of routes, there's no upper bound or removal mechanism.
contract StrategyMainnet is BaseStrategy {
bool public useOracle;
uint256 public nRoutes = 0;
mapping(uint256 => address[11]) public routes;
mapping(uint256 => uint256[5][5]) public swapParams;
mapping(uint256 => address[5]) public pools;
function addRoute(
address[11] calldata _route,
uint256[5][5] calldata _swapParams,
address[5] calldata _pools
) external onlyManagement {
routes[nRoutes] = _route;
swapParams[nRoutes] = _swapParams;
pools[nRoutes] = _pools;
nRoutes++;
}
}
This creates potential issues:
Unused state variables increase gas costs
No way to remove or update existing routes
Unlimited route additions could lead to storage bloat
No validation of route parameters beyond access control
https://github.com/Cyfrin/2024-12-alchemix/blob/82798f4891e41959eef866bd1d4cb44fc1e26439/src/StrategyMainnet.sol#L17
Prize pool breakdown
Total prize
16,653 OP
nSLOC
25366 OP / LOC
15,800
853
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.