XDZIBEC - XO-`updateUtilizationCurve` function does not check if the `newUtilizationCurve` is actually a valid `JumpRateUtilizationCurve`.

[sherlock-admin]

XDZIBEC

high

XO-updateUtilizationCurve function does not check if the newUtilizationCurve is actually a valid JumpRateUtilizationCurve.

Summary

• The vulnerability pertains to the updateUtilizationCurvefunction. The issue lies in the absence of a validation check for the newUtilizationCurve parameter, which represents a JumpRateUtilizationCurve. This omission allows an attacker to craft a malicious JumpRateUtilizationCurve with invalid values for the minRate, maxRate, or targetRateproperties. By invoking the updateUtilizationCurve function with this malevolent curve, the attacker can trigger a contract revert.

  Vulnerability Detail

  */
  function updateUtilizationCurve(IProduct product, JumpRateUtilizationCurve memory newUtilizationCurve) external onlyOwnerOrParamAdmin {
      if (newUtilizationCurve.minRate.unpack().abs().gt(MAX_CURVE_RATE)
          || newUtilizationCurve.maxRate.unpack().abs().gt(MAX_CURVE_RATE)
          || newUtilizationCurve.targetRate.unpack().abs().gt(MAX_CURVE_RATE)
      )
          revert CoordinatorDelegatableInvalidParamValueError();
      product.updateUtilizationCurve(newUtilizationCurve);
  }
  /**

• There is a vulnerability in the updateUtilizationCurve function. The problem with is that there is a line in the function it does not check if the newUtilizationCurve is actually a valid JumpRateUtilizationCurve. This means that an attacker could create a malicious JumpRateUtilizationCurve that has invalid values for the minRate, maxRate, or targetRate properties. If the attacker were able to do this, they could then call the updateUtilizationCurve function and cause the contract to revert.

  Impact

• An attacker could create a malicious JumpRateUtilizationCurve that has invalid values for the minRate, maxRate, or targetRate properties. If the attacker were able to do this, they could then call the updateUtilizationCurve function and cause the contract to revert.

  Code Snippet

• https://github.com/sherlock-audit/2023-05-perennial/blob/main/perennial-mono/packages/perennial/contracts/periphery/CoordinatorDelegatable.sol#L108C5-L118C8

  Tool used

Manual Review

Recommendation

• added require(newUtilizationCurve.isValid()); to the function, to check if the newUtilizationCurve is actually a valid JumpRateUtilizationCurve. If it is not, the function will revert.