Part 2
Zaros
PerpetualsDEXFoundrySolidity
70,000 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

Missing Array Length Validation in AssetSwapPath Configuration

akay

Summary

The AssetSwapPath.configure() function lacks validation to ensure that the length of dexSwapStrategyIds array matches assets.length - 1, which could lead to runtime errors in _performMultiDexSwap() function.

Vulnerability Details

In AssetSwapPath.sol, the configure() function allows setting up swap paths without validating the relationship between the assets and dexSwapStrategyIds arrays:

function configure(
Data storage self,
bool enabled,
address[] memory assets,
uint128[] memory dexSwapStrategyIds
)
internal
{
self.enabled = enabled;
self.assets = assets;
self.dexSwapStrategyIds = dexSwapStrategyIds;
}

However, in FeeDistributionBranch.sol, the _performMultiDexSwap() function assumes this relationship exists:

function _performMultiDexSwap(
AssetSwapPath.Data memory swapPath,
uint256 assetAmount
)
internal
returns (uint256)
{
address[] memory assets = swapPath.assets;
uint128[] memory dexSwapStrategyIds = swapPath.dexSwapStrategyIds;
​
for (uint256 i; i < assets.length - 1; i++) {
// Assumes dexSwapStrategyIds[i] exists
DexSwapStrategy.Data storage dexSwapStrategy = DexSwapStrategy.loadExisting(dexSwapStrategyIds[i]);
// ...
}
}

Impact

If dexSwapStrategyIds.length < assets.length - 1, there will be an array out of bounds error in _performMultiDexSwap() or if dexSwapStrategyIds.length > assets.length - 1, there will be unused strategy IDs and also waste of storage

Tools Used

  • Manual code review

Recommendations

Add validation in the configure() function of AssetSwapPath.sol:

function configure(
Data storage self,
bool enabled,
address[] memory assets,
uint128[] memory dexSwapStrategyIds
)
internal
{
// Validate array lengths
if (assets.length == 0 || dexSwapStrategyIds.length != assets.length - 1) {
revert Errors.InvalidSwapPath();
}
self.enabled = enabled;
self.assets = assets;
self.dexSwapStrategyIds = dexSwapStrategyIds;
}

This will ensure that the swap paths are configured correctly and prevent potential runtime errors in _performMultiDexSwap().

Updates

Lead Judging Commences

inallhonesty Lead Judge
10 months ago
inallhonesty Lead Judge 9 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.