BriVault
First Flight #52
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Impact: low
Likelihood: low
Invalid

getCountry Out-of-Bounds Check

jericho

Root + Impact

Description

The getCountry function retrieves a country record from a storage array (e.g., countries[index]) without verifying whether the provided index value is within the valid range of the array.

If the index parameter is greater than or equal to the array length, the transaction will revert due to an out-of-bounds array access.

While Solidity automatically reverts in such cases, the lack of explicit validation can lead to unclear error messages, unexpected reverts, and reduced contract robustness when the function is called externally (especially via other contracts or UI interfaces).

// Root cause in the codebase with @> marks to highlight the relevant section
function getCountry(uint256 countryId) external view returns (string memory) {
if (bytes(teams[countryId]).length == 0) { // @> getCountry Out-of-Bounds Check
revert invalidCountry();
}
​
return teams[countryId];
}

Risk

Likelihood:

  • Although Solidity’s runtime reversion prevents direct exploitation, this issue is considered a reliability and UX flaw rather than a critical security vulnerability.

    Improper validation could cause external integrations or frontends to fail unexpectedly and make debugging difficult.

    In certain upgradeable or complex contract systems, missing validation might propagate unintended revert behavior to other logical flows.


Impact:

  • No loss of funds or data corruption.

  • May lead to unexpected transaction failures and degraded user experience.

  • Could hinder contract composability and integration reliability if other contracts depend on this function.


Proof of Concept

Accessing a value outside the index range triggers an out-of-bounds panic.

function test_getCountryOutOfBounds() public {
vm.startPrank(owner);
briVault.setCountry(countries);
vm.expectRevert(stdError.indexOOBError);
briVault.getCountry(48);
}

Recommended Mitigation

Add an explicit bounds check before accessing the array:

@@ -178,6 +178,9 @@ contract BriVault is ERC4626, Ownable {
@notice get country
*/
function getCountry(uint256 countryId) external view returns (string memory) {
+ if(countryId >= teams.length) {
+ revert invalidCountry();
+ }
if (bytes(teams[countryId]).length == 0) {
revert invalidCountry();
}
Updates

Appeal created

bube Lead Judge 19 days ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!