Summary

Vulnerability Details

In the executeSwapExactInput function, the swap path is decoded from a bytes-encoded field:

• The function then uses the decoded tokens array in a for‑loop:

  `for (uint256 i; i < tokens.length - 1; i++) { … }

• There is no check to confirm that the decoded array has at least two elements

• If swapPayload.path is empty or improperly encoded, the tokens array might have fewer than two addresses. The loop condition tokens.length - 1 would underflow (if tokens.length is 0) or the loop would not execute as expected.

Impact

An attacker could provide an invalid swap path that causes the function to revert, thereby blocking the swap functionality

Tools Used

manual

Recommendations

**Validate the Swap Path:**Immediately after decoding, insert a check:

require(tokens.length >= 2, "CurveAdapter: invalid swap path");