XDEFI contest - jayjonah8's results

Handle

jayjonah8

Vulnerability details

Impact

In XDEFIDistribution.sol the setLockPeriods() function takes in 2 args (durations_ and multipliers) which are both arrays. The function does not insure that both arrays are the same length. So you can actually put in a larger number of durations_ than multipliers which is a problem because after every loop in the function of durations_.length an event is emitted for the multiplier at that index. If there are more _durations than multipliers this means that the events will be emitting incorrect data or even throwing errors because the multipliers array index would be out of bounds.

Proof of Concept

function setLockPeriods( uint256[] memory durations_, uint8[] memory multipliers ) external onlyOwner { uint256 count = durations_.length;

    for (uint256 i; i < count; ++i) {
        uint256 duration = durations_[i];
        require(duration <= uint256(18250 days), "INVALID_DURATION");
        emit LockPeriodSet(
            duration,
            bonusMultiplierOf[duration] = multipliers[i]
        );
    }
}

Tools Used

Manual code review

Recommended Mitigation Steps

Add a require check that both of the arrays are the same length like so:

function setLockPeriods( uint256[] memory durations_, uint8[] memory multipliers ) external onlyOwner { require(durations_.length == multipliers.length, "Arrays must be the same length"); uint256 count = durations_.length;

    for (uint256 i; i < count; ++i) {
        uint256 duration = durations_[i];
        require(duration <= uint256(18250 days), "INVALID_DURATION");
        emit LockPeriodSet(
            duration,
            bonusMultiplierOf[duration] = multipliers[i]
        );
    }
}