Part 2
Zaros
PerpetualsDEXFoundrySolidity
70,000 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

Lack of Input Validation - ZipVault.sol

jefextar

Summary

The initialize function does not validate the input parameters.

Vulnerability Details

The initialize function does not validate the input parameters, such as the marketMakingEngine address, decimalsOffset, owner, asset_, and vaultId. This could potentially allow an attacker to pass invalid or malicious input parameters, which could lead to unexpected behavior or vulnerabilities.

Impact

Invalid or malicious input parameters could lead to unexpected behavior or vulnerabilities, potentially causing financial loss or incorrect state.

Tools Used

Manual code review and analysis.

Recommendations

Add input validation checks in the initialize function to ensure that all input parameters are valid and within the expected range.

function initialize(
address marketMakingEngine,
uint8 decimalsOffset,
address owner,
IERC20 asset_,
uint128 vaultId
) external initializer {
require(marketMakingEngine != address(0), "Invalid market making engine address");
require(owner != address(0), "Invalid owner address");
require(address(asset_) != address(0), "Invalid asset address");
require(decimalsOffset <= 18, "Invalid decimals offset");
require(vaultId != 0, "Invalid vault ID");
​
__Ownable_init(owner);
__ERC4626_init(asset_);
​
ZlpVaultStorage storage zlpVaultStorage = _getZlpVaultStorage();
zlpVaultStorage.marketMakingEngine = marketMakingEngine;
zlpVaultStorage.decimalsOffset = decimalsOffset;
zlpVaultStorage.vaultId = vaultId;
​
IERC20(asset_).approve(marketMakingEngine, type(uint256).max);
}
Updates

Lead Judging Commences

inallhonesty Lead Judge 6 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.