Summary

The constructor directly pushes the provided HopConfig objects into the oracles array without validating the data. There are no checks to ensure that:

1. The oracle addresses provided in the HopConfig objects are valid and non-zero.

2. The invert flag is correctly configured for each oracle.
   This lack of validation creates a risk of invalid or misconfigured oracle data entering the system, which can lead to runtime errors or incorrect calculations when functions like _getData() rely on data.

Vulnerability Details

a user can provide an invalid address(0) calling the getData() function which will halt critical operations that depend on getData.

Impact

1. Incorrect Calculations:

• A misconfigured oracle address can lead to invalid results during data aggregation, potentially propagating incorrect values to dependent systems or calculations

2. Financial losses:

• In decentralized financial systems, reliance on incorrect oracle data can lead to mispriced trades, improper payouts, or loss of user funds

3. Gas wastage:

• It leads to gas wastage whereby each iteration of the loops involves storage write (oracles.push) which is expensive in solidity.

Tools Used

Manual Review

Recommendations

Add a validation checks in the constructor to ensure that only valid configurations are accepted