Phoenix-Protocol-Group / phoenix-contracts

Source code of the smart contracts of the Phoenix DeFi hub DEX protocol
GNU General Public License v3.0
10 stars 7 forks source link

[V-PHX-VUL-036] Unchecked assumptions of get_deposit_amounts arguments #230

Closed gangov closed 8 months ago

gangov commented 9 months ago

files: contracts/pool/src/storage.rs location: get_deposit_amounts

Based on the tests and usage in provide_liquidity, get_deposit_amounts assumes that: ▶ desired_a and desired_b are assumed to be > 0 ▶ min_a and min_b are >= 0 if they are not None

However, these assumptions are not explicitly checked in the function.

Impact: Implicit constraints may be accidentally violated in future versions of the code.

Recommendation: Add checks to the arguments passed to get_deposit_amounts.