search

code-423n4 / 2022-02-aave-lens-findings

0 stars 0 forks source link

QA Report #49

Open code423n4 opened 2 years ago

code423n4 commented 2 years ago

Low

  1. There is a common practice of not checking the inputs during the construction of the contracts (constructor)

  2. There is a common practice of not checking the inputs during the initialization of the contracts (initialize)

  3. Logic around handle verification is not completely secure, it's allow handles like .......

Zer0dot commented 2 years ago

Constructor issue solved in https://github.com/aave/lens-protocol/pull/80, initialization is a tradeoff we're willing to take, since the hub is only initialized at proxy construction, an error here would mean redeployment as far as I can tell, which is alright. The reason we implemented the checks in constructors is because constructors are not part of the runtime code, so don't affect the code size.

Handle stuff is meant to be delegated to whitelisted profile creators.