Lack of Array Size Validation in Function Calls

[codehawks-bot]

Lack of Array Size Validation in Function Calls

Severity

Medium Risk

Relevant GitHub Links

https://github.com/Cyfrin/2023-07-beedle/blob/main/src/Lender.sol

Summary

In the giveLoan() function, there's an absence of validation for the sizes of the loanIds and poolIds arrays. This oversight can lead to mismatches between loan IDs and pool IDs when iterating through the arrays. If the arrays have different lengths, it could result in some loans not being processed or being incorrectly associated with pools. This lack of validation can introduce unintended behavior, potentially causing inconsistencies in the contract's state or facilitating other vulnerabilities when combined with additional factors.

Vulnerability Details

In the giveLoan() function, the contract processes loans by iterating through the loanIds and poolIds arrays. The function assumes that both arrays have the same length, but there's no explicit validation to ensure this.

function giveLoan(
    uint256[] calldata loanIds,
    bytes32[] calldata poolIds
) external {
    for (uint256 i = 0; i < loanIds.length; i++) {
        uint256 loanId = loanIds[i];
        bytes32 poolId = poolIds[i];
        ...
    }
}

Impact

• Transaction Reversion: If the poolIds array is shorter than the loanIds array, an out-of-bounds access will occur, causing the entire transaction to revert. This means that legitimate operations could fail due to an oversight in providing matching array lengths.

• Inconsistent State: If the poolIds array is longer than the loanIds array, some pool IDs will be ignored. This could lead to situations where certain loans are not associated with their intended pools, causing unexpected behavior in subsequent interactions.

• Potential for Exploitation: While the direct implications of this oversight might seem benign, in the broader context of a complex system, such inconsistencies can sometimes be leveraged by attackers in conjunction with other vulnerabilities.

Tools Used

VSCode, Slither

Recommendations

• Array Length Validation: Implement a check at the beginning of the giveLoan() function to ensure that the lengths of the loanIds and poolIds arrays are equal. If they are not, revert the transaction with a clear error message.

require(loanIds.length == poolIds.length, "Mismatched array lengths");

• Clear Documentation: Update the function comments/documentation to clearly state that the lengths of the loanIds and poolIds arrays must be equal. This will help users and developers understand the expected input.

• Frontend Validation: If there's a user interface for this contract, add validation on the frontend to prevent users from submitting mismatched arrays. This can reduce the number of failed transactions and improve user experience.