If a user only specifies one of token name or symbol, both are set to the default value

[c4-bot-10]

Lines of code

https://github.com/code-423n4/2024-01-curves/blob/516aedb7b9a8d341d0d2666c23780d2bd8a9a600/contracts/Curves.sol#L440-L448

Vulnerability details

Impact

If a user only specifies one of token name or symbol, both are overriden and set to the default value. This prevents them from using their choice.

Proof of Concept

https://github.com/code-423n4/2024-01-curves/blob/516aedb7b9a8d341d0d2666c23780d2bd8a9a600/contracts/Curves.sol#L440-L448

if (
            keccak256(abi.encodePacked(externalCurvesTokens[curvesTokenSubject].name)) ==
            keccak256(abi.encodePacked("")) ||
            keccak256(abi.encodePacked(externalCurvesTokens[curvesTokenSubject].symbol)) ==
            keccak256(abi.encodePacked(""))
        ) {
            externalCurvesTokens[curvesTokenSubject].name = DEFAULT_NAME;
            externalCurvesTokens[curvesTokenSubject].symbol = DEFAULT_SYMBOL;
        }

Tools Used

Manual Review

Recommended Mitigation Steps

Check that either name and symbol are both provided or both empty, don't allow only one to be specifed.

Assessed type

Other

[c4-pre-sort]

raymondfam marked the issue as insufficient quality report

[c4-pre-sort]

raymondfam marked the issue as duplicate of #339

[c4-judge]

alcueca marked the issue as not a duplicate

[c4-judge]

alcueca changed the severity to QA (Quality Assurance)

[c4-judge]

alcueca marked the issue as grade-b

[andresaiello]

expected behavior

[c4-sponsor]

andresaiello (sponsor) disputed