Skip to content

Latest commit

 

History

History
49 lines (28 loc) · 1.72 KB

052.md

File metadata and controls

49 lines (28 loc) · 1.72 KB
Raw

Sparkly Fleece Mammoth

Medium

Magic numbers in the morpho.sol contract hardcoded to zero

Summary

return values of function getSupplyCollateralCalldata, function invokeSupplyCollateral,function getBorrowCalldata function invokeBorrow, function getWithdrawCollateralCalldata, function invokeWithdrawCollateral function invokeRepay, https://github.com/sherlock-audit/2024-10-morpho-x-index/blob/main/index-protocol/contracts/protocol/integration/lib/Morpho.sol#L54

https://github.com/sherlock-audit/2024-10-morpho-x-index/blob/main/index-protocol/contracts/protocol/integration/lib/Morpho.sol#L98

https://github.com/sherlock-audit/2024-10-morpho-x-index/blob/main/index-protocol/contracts/protocol/integration/lib/Morpho.sol#L118

have their shares/asset hard coded zero. while one of the input of either the borrowed asset/shares shout be zero, it is more flexible to allow a uint256 variable as a place holder and a require statement to ensure zero being passed

Root Cause

No response

Internal pre-conditions

No response

External pre-conditions

No response

Attack Path

No response

Impact

-where the user passes in a non zero borrowed asset, the function would run but fail, leading to unexpected behaviour from the codes because the revert is not well handled. -user may not understand reason for failed transaction -gas is also spent on a transaction that fails.

PoC

No response

Mitigation

-since borrowed assets input by user has to be zero, require statements at the beginning of the function to validate that one of these values is indeed zero before further logic, along with a clear revert message.

  • proper documentation on the open source code as well as the user interface