blast-io / blast

97 stars 52 forks source link

2 Fixes: An attempt to access a variable that has not been declared yet and a check that always returns an error. #6

Closed infosec-us-team closed 6 months ago

infosec-us-team commented 8 months ago

Inside the functions checkUSDB and checkWETHRebasing of blast-optimism/op-chain-ops/cmd/check-l2/main.go, instead of checking the decimals to be equal to 18, we enforce the price of the token to be equal to 18.

    decimals, err := contract.Decimals(&bind.CallOpts{}) // This line reads the decimals
    if err != nil {
        return err
    }
    if price != 18 { // This line should compare the value of decimals with 18, but instead compares the price
        return fmt.Errorf("Decimals is incorrect")
    }

Additionally, we attempt to access the value of the variable "price" several lines of code before we declare it.

    if price != 18 { // <- We try to access the value of "price" here
        return fmt.Errorf("Decimals is incorrect")
    }
    log.Info("USDB", "decimals", decimals)

    price, err := contract.Price(&bind.CallOpts{}) // <- Here is were we declare "price"

This pull request fixes all of the above.