Caviar contest - 8olidity's results

Lines of code

https://github.com/code-423n4/2022-12-caviar/blob/main/src/Pair.sol#L390-L392

Vulnerability details

Impact

When computing the price, the baseTokenReserves are multiplied by the hardcoded ONE. Then divide by fractionalTokenReserves(). Both ONE and fractionalToken have a precision of 18. But there are no special requirements for the accuracy of the basetoken. Add basetoken as usdt. The precision is 6. Then the result of the price() function will be too small. may also be 0

Proof of Concept

    function price() public view returns (uint256) {
        return (_baseTokenReserves() * ONE) / fractionalTokenReserves(); //@audit 
    }

Tools Used

vscode

Recommended Mitigation Steps

The decimals of the basetoken are required to be 18

Lines of code

https://github.com/code-423n4/2022-12-caviar/blob/main/src/Pair.sol#L463-L472

Vulnerability details

Impact

_validateTokenIds() does not check the length of the incoming tokenIds and proofs arrays.The length of proofs array may be less than the length of tokenIds

Proof of Concept

    function _validateTokenIds(uint256[] calldata tokenIds, bytes32[][] calldata proofs) internal view {//@audit  
        // if merkle root is not set then all tokens are valid
        if (merkleRoot == bytes23(0)) return;

        // validate merkle proofs against merkle root
        for (uint256 i = 0; i < tokenIds.length; i++) {
            bool isValid = MerkleProofLib.verify(proofs[i], merkleRoot, keccak256(abi.encodePacked(tokenIds[i])));
            require(isValid, "Invalid merkle proof");
        }
    }

Tools Used

vscode

Recommended Mitigation Steps

require(tokenIds.length == proofs.length);