Summary

The configureConnectedVaults function in Market.sol incorrectly accesses an out-of-bounds index in the connectedVaults array, leading to a denial-of-service condition that disrupts market configuration.

The configureConnectedVaults function is designed to add a new set of vault IDs to the market’s list of connected vaults. But it incorrectly uses connectedVaults[connectedVaults.length] as the target index for insertion.

In Solidity, dynamic arrays are zero-indexed, and a valid index is in the range [0, length - 1]. Accessing connectedVaults[connectedVaults.length] is out-of-bounds and will always revert, especially when the array is empty. This prevents the registration of vaults necessary for credit delegation and operational functionality.

Impact

The impact of this vulnerability is high because it directly disrupts core market configuration functionality. The inability to properly add vault IDs to the connected vaults array results in a denial-of-service for market configuration. This can impair market operations, leading to misallocation of credit, failed liquidations, and significant financial consequences for the protocol.

Tools Used

Manual review

Proof of Concept

Assume an administrator attempts to connect vaults to a market by calling a higher-level function that internally calls configureConnectedVaults with an array of vault IDs. With an initially empty connectedVaults array:

1. The administrator passes an array, e.g., [vaultId1, vaultId2].

1. During execution, the loop iterates and tries to execute:

3. If connectedVaults.length is 0 (empty array), the code attempts to access connectedVaults[0]—but since no element exists, it reverts.

4. Even if the array is non-empty, using the index equal to the array’s length is always out-of-bounds.

This out-of-bounds access will cause the transaction to revert, preventing the configuration of connected vault

Recommendations

Modify the function to properly create a new UintSet instance by using the push() method and then use the correct index for adding vault IDs: