hats-finance / AlephZeroAMM-0x0d88a9ece90994ecb3ba704730819d71c139f60f

Apache License 2.0
1 stars 0 forks source link

Unhandled Situation and Panic in `farm::claim_rewards` #38

Open hats-bug-reporter[bot] opened 7 months ago

hats-bug-reporter[bot] commented 7 months ago

Github username: @0xmahdirostami Twitter username: 0xmahdirostami Submission hash (on-chain): 0x9353aea6c66766c382ebd8111e229e0dc815859cb5152afd7a7060eeeb55a192 Severity: minor

Description: Description\ In the farm::claim_rewards function, if the provided index (idx) by the user is unavailable, the function panics instead of returning an error result.

let token = self.reward_tokens[idx];

Impact\

The impact of this issue is considered minor. Panicking is an unrecoverable situation that terminates the program, and it's typically used for handling fatal errors or bugs in the program.

  1. Proof of Concept (PoC) File

https://github.com/hats-finance/AlephZeroAMM-0x0d88a9ece90994ecb3ba704730819d71c139f60f/blob/b097173adc9966bcbed72c6a4f1b50fcc52fe0ef/farm/contract/lib.rs#L341-L343

  1. Revised Code File (Optional)

It's recommended to add checks to ensure that the provided index (idx) is within the valid range of tokens.len(). Additionally, consider verifying that the length of tokens: Vec<u8> is lower than or equal to tokens.len() to prevent potential issues.

deuszx commented 7 months ago

Thank you for participation. After carefully reviewing the submission we've concluded that this issue is INVALID.

From the perspective of a caller, panicing and returning an error are equivalent (ie the error is not returned to the sender of a transaction in ink!).

We hope you participate in the future audits of ink!.