Velvet-Capital / Velvet-v4

V4 (thena+venus) on top of v3
Other
0 stars 0 forks source link

Potential Out-of-Bounds Error in Rebalancing Contract's updateTokens Function #39

Closed Havoc19 closed 2 weeks ago

Havoc19 commented 1 month ago

In the updateTokens function of the Rebalancing contract, there is a potential out-of-bounds error when calculating the dustValue for each token. The current implementation assumes a direct correspondence between the _tokens array and the rebalanceData._sellAmounts array, which may not always be the case.

Code -

for (uint256 i; i < tokenLength; i++) {
      address _portfolioToken = _tokens[i];
      if (tokensMapping[_portfolioToken]) {
        uint256 dustValue = (rebalanceData._sellAmounts[i] *
          protocolConfig.allowedDustTolerance()) / TOTAL_WEIGHT;
        if (_getTokenBalanceOf(_portfolioToken, _vault) > dustValue)
          revert ErrorLibrary.BalanceOfVaultShouldNotExceedDust();
      }
      delete tokensMapping[_portfolioToken];
    }