Submission Details
Severity:
Missing input validation for DEX swap strategy paths in FeeDistributionBranch.sol::performMultiDexSwap
Summary
The function _performMultiDexSwap lacks validation for the length of dexSwapStrategyIds, which could lead to errors.
Vulnerability Details
No validation that dexSwapStrategyIds.length matches assets.length - 1.
Could result in array out-of-bounds errors or incomplete swaps.
function _performMultiDexSwap(
AssetSwapPath.Data memory swapPath,
uint256 assetAmount
)
internal
returns (uint256)
{
address[] memory assets = swapPath.assets;
uint128[] memory dexSwapStrategyIds = swapPath.dexSwapStrategyIds;
// No validation that dexSwapStrategyIds.length == assets.length - 1
uint256 amountIn = assetAmount;
for (uint256 i; i < assets.length - 1; i++) {
DexSwapStrategy.Data storage dexSwapStrategy =
DexSwapStrategy.loadExisting(dexSwapStrategyIds[i]);
...
}
return amountIn;
}
Impact
Potential protocol invariants breakage and incomplete swaps.
Tools Used
Manual code review.
Recommendations
Validate the length of
dexSwapStrategyIdsagainstassets.length - 1.Ensure
assetscontains at least two elements.
Prize pool breakdown
Total prize
70,000 USDC
nSLOC
3,25821
USDC / LOC
66,500
3,500
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.