Stratax Contracts
First Flight #57
Beginner FriendlyDeFi
100 EXP
View all submissions
Previous Next
Submission Details
Impact: low
Likelihood: low

Missing Zero-Address Validation in Stratax::calculateUnwindParams Can Cause Misconfiguration Reverts

Author Revealed upon completion

Missing Zero-Address Validation in Stratax::calculateUnwindParams Can Cause Misconfiguration Reverts

Description:
Stratax::calculateUnwindParams does not validate _collateralToken and _borrowToken before using them in external calls:

function calculateUnwindParams(address _collateralToken, address _borrowToken)
public
view
returns (uint256 collateralToWithdraw, uint256 debtAmount)
{
(,, address debtToken) = aaveDataProvider.getReserveTokensAddresses(_borrowToken);
...
uint256 collateralTokenPrice = IStrataxOracle(strataxOracle).getPrice(_collateralToken);
}
​

If either token parameter is address(0), the function may revert or produce undefined behavior depending on downstream calls (Aave data provider, oracle, IERC20.decimals()).

Impact:
Low. This is mainly an input-sanity / robustness issue that can lead to confusing reverts and operational mistakes, especially when this function is used by frontends or scripts.

Recommended Mitigation:

function calculateUnwindParams(address _collateralToken, address _borrowToken)
public
view
returns (uint256 collateralToWithdraw, uint256 debtAmount)
{
+ require(_collateralToken != address(0), "Invalid collateral token");
+ require(_borrowToken != address(0), "Invalid borrow token");
...
}
​

(Optionally also validate strataxOracle != address(0) if it’s not guaranteed elsewhere.)

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!