search

code-423n4 / 2021-07-spartan-findings

0 stars 0 forks source link

Assuming `BEP20.name` of a token is implemented #226

Open code423n4 opened 3 years ago

code423n4 commented 3 years ago

Handle

shw

Vulnerability details

Impact

According to the BEP20 specification, the name method is optional:

OPTIONAL - This method can be used to improve usability, but interfaces and other contracts MUST NOT expect these values to be present.

However, when creating a synth or pool, the name method of the given token is assumed to be implemented. Thus, BEP20 tokens not implementing the name method cannot be used to create a synth or a pool since the creation of the contracts always reverts.

Proof of Concept

Referenced code: Synth.sol#L41 Pool.sol#L48

Recommended Mitigation Steps

Handle cases where the name method of the given token is not implemented. For example, check if the call to name reverts. If so, uses an empty string as the name instead.

SamusElderg commented 3 years ago

This is by design; the intention is to not allow the listing of pools (and therefore synths) that do not have the name function

ghoul-sol commented 3 years ago

Per sponsor comment, invalid