Closed code423n4 closed 1 year ago
https://github.com/code-423n4/2023-06-canto/blob/a4ff2fd2e67e77e36528fad99f9d88149a5e8532/Canto/x/onboarding/types/params.go#L15 https://github.com/code-423n4/2023-06-canto/blob/a4ff2fd2e67e77e36528fad99f9d88149a5e8532/Canto/x/onboarding/types/params.go#L6 https://github.com/code-423n4/2023-06-canto/blob/a4ff2fd2e67e77e36528fad99f9d88149a5e8532/Canto/x/coinswap/keeper/swap.go#L5 https://github.com/code-423n4/2023-06-canto/blob/a4ff2fd2e67e77e36528fad99f9d88149a5e8532/Canto/go.mod#L7
Codes in the scope won't work if the https://github.com/code-423n4/2023-06-canto/blob/a4ff2fd2e67e77e36528fad99f9d88149a5e8532/Canto/go.mod#L7C1-L7C38 would be updated.
It is clearly seen that in the https://github.com/code-423n4/2023-06-canto/blob/a4ff2fd2e67e77e36528fad99f9d88149a5e8532/Canto/go.mod#L7C1-L7C38 it is fixed version of v0.45.9. However, in next version of cosmos-sdk https://pkg.go.dev/github.com/cosmos/cosmos-sdk@v0.46.0/types#Int all of the Int methods will be deprecated.
Almost all of the code in the scope is in danger.
Manual review.
Use native functions to do the same things or use another package to do the same thing.
Library
JeffCX marked the issue as primary issue
JeffCX marked the issue as low quality report
0xean marked the issue as unsatisfactory: Insufficient quality
Lines of code
https://github.com/code-423n4/2023-06-canto/blob/a4ff2fd2e67e77e36528fad99f9d88149a5e8532/Canto/x/onboarding/types/params.go#L15 https://github.com/code-423n4/2023-06-canto/blob/a4ff2fd2e67e77e36528fad99f9d88149a5e8532/Canto/x/onboarding/types/params.go#L6 https://github.com/code-423n4/2023-06-canto/blob/a4ff2fd2e67e77e36528fad99f9d88149a5e8532/Canto/x/coinswap/keeper/swap.go#L5 https://github.com/code-423n4/2023-06-canto/blob/a4ff2fd2e67e77e36528fad99f9d88149a5e8532/Canto/go.mod#L7
Vulnerability details
Impact
Codes in the scope won't work if the https://github.com/code-423n4/2023-06-canto/blob/a4ff2fd2e67e77e36528fad99f9d88149a5e8532/Canto/go.mod#L7C1-L7C38 would be updated.
Proof of Concept
It is clearly seen that in the https://github.com/code-423n4/2023-06-canto/blob/a4ff2fd2e67e77e36528fad99f9d88149a5e8532/Canto/go.mod#L7C1-L7C38 it is fixed version of v0.45.9. However, in next version of cosmos-sdk https://pkg.go.dev/github.com/cosmos/cosmos-sdk@v0.46.0/types#Int all of the Int methods will be deprecated.
Almost all of the code in the scope is in danger.
Tools Used
Manual review.
Recommended Mitigation Steps
Use native functions to do the same things or use another package to do the same thing.
Assessed type
Library