The Basket.validateWeights function checks the uniqueness of the tokens by iterating over all tokens for each token.
This runs in O(_tokens.length^2) and is very inefficient as the number of tokens increases.
Recommended Mitigation Steps
Sort the tokens off-chain and provide them already in a sorted (ascending) way.
Then the validateWeights function only needs to verify that the tokens are indeed strictly sorted which runs in linear time:
for (uint i = 0; i < length; i++) {
require(_tokens[i] != address(0));
require(_weights[i] > 0);
// check sorted to ensure uniqueness
if (i > 0) {
require(_tokens[i] > _tokens[i - 1]);
}
}
Handle
cmichel
Vulnerability details
The
Basket.validateWeights
function checks the uniqueness of the tokens by iterating over all tokens for each token. This runs inO(_tokens.length^2)
and is very inefficient as the number of tokens increases.Recommended Mitigation Steps
Sort the tokens off-chain and provide them already in a sorted (ascending) way. Then the
validateWeights
function only needs to verify that the tokens are indeed strictly sorted which runs in linear time: