Skip to content
Request an audit

‹ All findings

PHyperLPoolSwapInside::_swapWithCustomData() should check if the router has code

Low/InfoClip Finance Strategy Upgrade·by the Three Sigma team·DeFi infrastructure·15th March 20243S-Clip-L06

Report PageSource

Description

PHyperLPoolSwapInside::_swapWithCustomData() performs swap using a router provided as argument in swapData.

Solidity performs contract length checks when using an interface, but not when using .call(), making this call dangerous as success will be true.

Recommendation

Use Openzeppelin's Address::functionCall() which performs all the checks.

Status

Addressed in #0c8de23.

Found during Three Sigma’s team review · 0xSimao on the review team