Submission Details
Severity:
Lack of `useRawPrice` parameter validation
Summary
Though the ChannelFollowingUpdateRule validates the useRawPrice parameter correctness, other rules, which also use it, do not provide such check.
Vulnerability Details
ChannelFollowingUpdateRule:
function validParameters(int256[][] calldata _parameters) external pure override returns (bool) {
<...>
// Check parameter 7 is scalar (length 1) and is either 0 or 1
if (_parameters[6].length != 1) return false;
>> if (_parameters[6][0] != 0 && _parameters[6][0] != PRBMathSD59x18.fromInt(1)) return false;
return true;
}
AntiMomentumUpdateRule, MomentumUpdateRule and PowerChannelUpdateRule lack such a check.
Impact
Unexpected behavior
Tools used
Manual Review
Recommendations
Consider implementing the corresponding check
Prize pool breakdown
Total prize
49,600 OP
nSLOC
3,00017 OP / LOC
44,640
4,960
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.