search

code-423n4 / 2021-10-tally-findings

0 stars 0 forks source link

Lack of input validtion of function perimeter while setting swapfee() and feeRecipient() #47

Closed code423n4 closed 2 years ago

code423n4 commented 2 years ago

Handle

JMukesh

Vulnerability details

Impact

Due to lack of input validation in setSwapFee() and setFeeRecipient() ,they allow zero value of swapfee and address(0) for the setFeeRecipient

Proof of Concept

https://github.com/code-423n4/2021-10-tally/blob/c585c214edb58486e0564cb53d87e4831959c08b/contracts/swap/Swap.sol#L63

https://github.com/code-423n4/2021-10-tally/blob/c585c214edb58486e0564cb53d87e4831959c08b/contracts/swap/Swap.sol#L73

Tools Used

manual review

Recommended Mitigation Steps

add input validation in setter function

Shadowfiend commented 2 years ago

Both zero value for swap fee and address(O) for the fee recipient are desired possibilities, if governance chooses to use them.

0xean commented 2 years ago

gonna side with sponsor on this one and close it. While setting the swap fee to 0 is probably more likely than the address, I can see merit in either.