search

code-423n4 / 2022-01-sandclock-findings

0 stars 0 forks source link

NonUSTStrategy: Ensure correct underlying index #151

Closed code423n4 closed 2 years ago

code423n4 commented 2 years ago

Handle

hickuphh3

Vulnerability details

Impact

I recommend checking ICurve(_curvePool).coins(_underlyingI) == underlying), because it verifies the correctness of the following parameters:

  1. The curve pool address _curvePool
  2. The underlying index _underlyingI
  3. The underlying token address underlying

Recommended Mitigation Steps

Add the following check in the constructor.

require(ICurve(_curvePool).coins(_underlyingI) == underlying, "invalid setting");
naps62 commented 2 years ago

Isn't this a duplicate of #152 ?