code423n4 commented 1 year ago

Lines of code

https://github.com/code-423n4/2023-06-canto/blob/main/Canto/x/onboarding/types/params.go#L75

Vulnerability details

Impact

The bug in the contract leads to incorrect validation of the autoSwapThreshold parameter. This has the following impacts:

Incorrect Parameter Validation: The bug allows negative values to pass as valid for the autoSwapThreshold parameter. This contradicts the intended behavior, as the threshold should be a positive value. It can lead to unexpected behavior or incorrect calculations in the contract logic that relies on this parameter.
Inconsistent Validation: The inconsistency in validating the autoSwapThreshold parameter undermines the reliability and robustness of the contract package. It may cause confusion for developers and users, as the validation does not accurately enforce the intended constraints.
Potential Vulnerabilities: If the contract logic relies on the autoSwapThreshold parameter to make critical decisions, the incorrect validation could introduce vulnerabilities. For example, if a negative value is considered valid, it may lead to incorrect calculations or unintended behavior, potentially impacting the security and integrity of the contract.
- Maintenance Challenges: The bug may create maintenance challenges for future updates or modifications to the code. If developers rely on the current incorrect behavior, fixing the bug could potentially break existing contracts or cause compatibility issues.

It is crucial to address this bug by correcting the validation logic to ensure the autoSwapThreshold parameter is properly validated as a positive value.

Proof of Concept

This contract implements a contract package for managing parameters. , I identified a bug related to the validation of the autoSwapThreshold field. The bug allows a negative value to be considered valid, which contradicts the intended behavior of the code.

Steps to Reproduce:

1 . Set a negative value for the autoSwapThreshold parameter. 2 . Call the Validate function on the Params struct.

Expected Results: The validation should fail and return an error indicating that the auto swap threshold must be positive.

Actual Results: The validation does not detect the negative value as an error, and the validation process completes without raising any issues.

Additional Details:

The bug is located in the validateAutoSwapThreshold function, which is responsible for validating the autoSwapThreshold parameter. The function attempts to type-assert the input value (i) as an sdk.Int. However, the assertion check is incorrect, leading to the bug. The correct type assertion should be v, ok := i.(*sdk.Int) instead of v, ok := i.(sdk.Int).

Proposed Fix:

To fix the bug, the validateAutoSwapThreshold function should be modified as follows:

func validateAutoSwapThreshold(i interface{}) error { v, ok := i.(*sdk.Int) if !ok { return fmt.Errorf("invalid parameter type: %T", i) }

if v.IsNegative() {
    return fmt.Errorf("auto swap threshold must be positive: %s", v.String())
}

return nil

}

After applying this fix, the validateAutoSwapThreshold function will correctly validate the autoSwapThreshold parameter and ensure that it is a positive value.

Assessed type

Invalid Validation

c4-pre-sort commented 1 year ago

JeffCX marked the issue as low quality report

JeffCX commented 1 year ago

This requires very significant admin misconfiguration, QA

c4-judge commented 1 year ago

0xean changed the severity to QA (Quality Assurance)