Input validation for protocol’s non-address parameters is critical similar to zero-address checks for address parameters. While the onlyOwner setters of InterestRateModel perform input validation via threshold checks, the constructor is missing these checks which will allow the contract to be accidentally deployed with incorrect protocol parameters.
Handle
0xRajeev
Vulnerability details
Impact
Input validation for protocol’s non-address parameters is critical similar to zero-address checks for address parameters. While the onlyOwner setters of InterestRateModel perform input validation via threshold checks, the constructor is missing these checks which will allow the contract to be accidentally deployed with incorrect protocol parameters.
Proof of Concept
https://github.com/code-423n4/2021-09-wildcredit/blob/c48235289a25b2134bb16530185483e8c85507f8/contracts/InterestRateModel.sol#L37-L40
https://github.com/code-423n4/2021-09-wildcredit/blob/c48235289a25b2134bb16530185483e8c85507f8/contracts/InterestRateModel.sol#L44
https://github.com/code-423n4/2021-09-wildcredit/blob/c48235289a25b2134bb16530185483e8c85507f8/contracts/InterestRateModel.sol#L50
https://github.com/code-423n4/2021-09-wildcredit/blob/c48235289a25b2134bb16530185483e8c85507f8/contracts/InterestRateModel.sol#L61
Tools Used
Manual Analysis
Recommended Mitigation Steps
Add input validation to constructor similar to what’s done in setters.