Part 2
Zaros
PerpetualsDEXFoundrySolidity
70,000 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

Missing input validation in `AssetSwapPath::configure`

auditbyte

Vulnerability Details

The function does not validate the inputs assets and dexSwapStrategyIds. If these arrays are empty, mismatched, or contain invalid values, the function could lead to inconsistent or incorrect state.

Code

function configure(
Data storage self,
bool enabled,
address[] memory assets,
uint128[] memory dexSwapStrategyIds
)
internal
{
self.enabled = enabled;
self.assets = assets;
self.dexSwapStrategyIds = dexSwapStrategyIds;
}

Impact

If these arrays are empty, mismatched, or contain invalid values, the function could lead to inconsistent or incorrect state.

Recommendations

Add input validation to ensure:

  1. assets and dexSwapStrategyIds are not empty.

  2. The length of assets is one greater than the length of dexSwapStrategyIds (since n swaps require n+1 assets).

  3. Each asset address is valid (not the zero address).

Updates

Lead Judging Commences

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.