search

code-423n4 / 2021-06-gro-findings

0 stars 1 forks source link

`Exposure.sortVaultsByDelta` does not work for N_COINS != 3 #101

Open code423n4 opened 3 years ago

code423n4 commented 3 years ago

Handle

cmichel

Vulnerability details

Vulnerability Details

The Exposure.sortVaultsByDelta function computes the missing vault index from the min and max vault indices by:

vaultIndexes[1] = N_COINS - maxIndex - minIndex;

This only works for N_COINS = 3.

Impact

If any new stablecoin is ever removed or added, this function will break.

Recommended Mitigation Steps

Never change the number of stablecoins and consider adding an assert(N_COINS == 3) here.

kitty-the-kat commented 2 years ago

non-critical: By its nature, exposure and allocations should be redeployed if any fundamental changes are done to the underlying exposure types

ghoul-sol commented 2 years ago

In summary, works as designed. Non-critical.