code-423n4 / 2022-03-lifinance-findings

6 stars 4 forks source link

QA Report #215

Open code423n4 opened 2 years ago

code423n4 commented 2 years ago

Check that the array lengths are the same since it's the string that is the key that maps to the specific configs:

https://github.com/code-423n4/2022-03-lifinance/blob/699c2305fcfb6fe8862b75b26d1d8a2f46a551e6/src/Facets/HopFacet.sol#L49

Consider emitting events for addDex() & removeDex(). Useful for user to be timely updated about the available Dexes:

https://github.com/code-423n4/2022-03-lifinance/blob/699c2305fcfb6fe8862b75b26d1d8a2f46a551e6/src/Facets/DexManagerFacet.sol#L17

https://github.com/code-423n4/2022-03-lifinance/blob/699c2305fcfb6fe8862b75b26d1d8a2f46a551e6/src/Facets/DexManagerFacet.sol#L44

Ensure that there's enough balance before making a swap:

(https://github.com/code-423n4/2022-03-lifinance/blob/699c2305fcfb6fe8862b75b26d1d8a2f46a551e6/src/Facets/GenericSwapFacet.sol#L28)

For the aforementioned, require (postBalance>0, ‘’)

Check that the length of the array is >0:

https://github.com/code-423n4/2022-03-lifinance/blob/699c2305fcfb6fe8862b75b26d1d8a2f46a551e6/src/Facets/NXTPFacet.sol#L87

https://github.com/code-423n4/2022-03-lifinance/blob/699c2305fcfb6fe8862b75b26d1d8a2f46a551e6/src/Facets/NXTPFacet.sol#L152

the check in _executeSwap() is invalidated as there's no condition available since the array is empty.

H3xept commented 2 years ago

Enough balance before swap is fixed by lifinance/lifi-contracts@91870a578e8dd315b057acc5eb3370ffa0186208

H3xept commented 2 years ago

Re Ensure that there's enough balance before making a swap

Duplicate of #76