search

code-423n4 / 2021-11-nested-findings

1 stars 1 forks source link

OperatorResolver.areAddressesImported doesn't check lengths of argument arrays #210

Open code423n4 opened 2 years ago

code423n4 commented 2 years ago

Handle

hyh

Vulnerability details

Impact

Array bounds check violation will happen if the function be called with arrays of different lengths.

Proof of Concept

Loop is performed by names array, while both arrays are accessed:

for (uint256 i = 0; i < names.length; i++) {
        if (operators[names[i]] != destinations[i]) {

https://github.com/code-423n4/2021-11-nested/blob/main/contracts/OperatorResolver.sol#L27

Recommended Mitigation Steps

Add a check:

require(names.length == destinations.length, "OperatorResolver::areAddressesImported: Input lengths must match");