Liquidity Management
Gamma
DeFiFoundry
50,000 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

* First parameter in the `add()` function should be type `Bytes32Set` instead of `struct Set`

scott1215

Summary

first parameter in the add() function should be type Bytes32Set, but actual parameter mapping userDeposits[msg.sender] is fanally defined as struct Set { bytes32[] _values; mapping(bytes32 => uint256) _indexes; }.

EnumerableSet.add(userDeposits[msg.sender], counter);

https://github.com/CodeHawks-Contests/2025-02-gamma/blob/84b9da452fc84762378481fa39b4087b10bab5e0/contracts/PerpetualVault.sol#L231

Vulnerability Details

first parameter in the add() function should be type Bytes32Set, but the actual parameter there is userDeposits[msg.sender],and then userDeposits[msg.sender] --> mapping (address => EnumerableSet.UintSet) userDeposits --> struct UintSet { Set _inner; } --> struct Set { bytes32[] _values; mapping(bytes32 => uint256) _indexes; };

EnumerableSet.add(userDeposits[msg.sender], counter);
mapping (address => EnumerableSet.UintSet) userDeposits;
struct UintSet {
Set _inner;
}
struct Set {
// Storage of set values
bytes32[] _values;
// Position of the value in the `values` array, plus 1 because index 0
// means a value is not in the set.
mapping(bytes32 => uint256) _indexes;
}
​

Impact

The wrong data type is used, it lead to incorrect deposit tracking, which can affect user withdrawals and overall contract functionality.

Tools Used

manual

Recommendations

Ensure that the data type used in the userDeposits mapping aligns with the expected data type in the add() function. If the intention is to use Bytes32Set, update the mapping accordingly.

Updates

Lead Judging Commences

n0kto Lead Judge 9 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

Suppositions

There is no real proof, concrete root cause, specific impact, or enough details in those submissions. Examples include: "It could happen" without specifying when, "If this impossible case happens," "Unexpected behavior," etc. Make a Proof of Concept (PoC) using external functions and realistic parameters. Do not test only the internal function where you think you found something.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.