Closed 1nc0gn170 closed 6 months ago
@0xneves @alextnetto Please have a look!
Hey @1nc0gn170 , thank you so much for your submission!!
As you enlightened us, the mload
is wrong - should be mload(i)
instead of mload(0x40)
but not needed for the current increment since already in memory. This issue you pointed out will need to be considered as well for refactoring the entire test scope as more validation is needed to catch such errors in the future.
The unchecked should be removed from every inline assembly as proposed!
Regarding best practices for token safety, I believe it can be reinforced in the front end instead, especially because safeTransferFrom is not implemented in all types of tokens. For this first version where don't threat every case separately, we will delegate token safety to the user himself. In next versions we indeed will create function such as safeAccetSwap
where we call safeTokenTransfer
instead.
Hey @0xneves made a PR that closes it #195
Thanks for the quick response! Also few minor changes can be enforced!
expired
swap or swap with 0
assets, by directly passing incorrect values to the function createSwap
. Even though the checks were enforced in makeSwap
function, user can bypass them by calling createSwap
function.0
to save gas.
for (uint256 i = 0; i < assets.length; ) {
=> for (uint256 i; i < assets.length; ) {
Thanks!
Hey @1nc0gn170, thanks a lot for your efforts in reviewing the code!
Bug Report
Hey Team!
Just had a brief look at swaplace contracts and would like to report a couple of issues!
Issues List:
Swaplace.acceptSwap()
, while iterating over assets, counter is updated incorrectly;This is actually incorrect, it should be just this
Note: Also there is no need to use
unchecked
for assembly, no validation for overflows happens inside assembly block.transferFrom
instead ofsafeTransferFrom
safeTransferFrom
can introducereentrancy
issues use reentrancy guard.safeTransferFrom
also maintain a token whitelist.For any further help regarding audits please reach out to me here: https://cantina.xyz/u/1nc0gn170 Thanks