XDZIBEC - XO-`_versionToPhase` Function Allows `Unauthorized Access`

[sherlock-admin]

XDZIBEC

medium

XO-_versionToPhase Function Allows Unauthorized Access

Summary

• the _versionToPhase function. contain a vulnerability this function is is used to convert a version number to a phase. the problem is that the function will stop iterating if the phase ID reaches 0, this can exploit by an attacker and cause unauthorized access to the contract or manipulate the system.

  Vulnerability Detail

  function _versionToPhase(uint256 version) private view returns (Phase memory phase) {
      uint256 phaseId = _latestPhaseId();
      phase = _phases[phaseId];
      while (uint256(phase.startingVersion) > version) {
          phaseId--;
          phase = _phases[phaseId];
      }
  }

• The vulnerability in the _versionToPhase function, the function iterates through the phases until it finds a phase with a starting version that is less than or equal to the version, the problem is in this loop. The loop will stop if the phase ID reaches 0, even if the version is still greater than the starting version of any phase. means that the _versionToPhase function will return an invalid phase if the version is greater than the starting version of the last phase, this can exploited by an attacker to create an invalid phase. and the attacker could then submit this invalid phase to the contract, which would allow the attacker to bypass the security checks that are in place to prevent unauthorized access to the contract.

  Impact

• attacker can bypass security measures and potentially gain unauthorized access to the contract or manipulate the system.

  Code Snippet

• https://github.com/sherlock-audit/2023-05-perennial/blob/main/perennial-mono/packages/perennial-oracle/contracts/ChainlinkOracle.sol#L137C3-L145C1

  Tool used

Manual Review

Recommendation

• change the loop in the _versionToPhase function so that it continues to iterate even if the phase ID reaches 0. This would ensure that the _versionToPhase function will never return an invalid phase.