Skip to content
Request an audit

‹ All findings

OstiumLinkUpKeep:topUp() is missing a length check for registryAddresses

Low/InfoOstium·Three Sigma · RWA perpetuals DEX · 19th February, 20243S-OS-L11

ReportSource

Description

solidity
OstiumLinkUpKeep:topUp() checks if (upkeepIDs.length != topUpAmounts.length)
revert WrongParams();, but does not include the length of registryAddresses, which is

expected to be equal, as seen in OstiumLinkUpKeep:getUnderfundedUpkeeps().

Recommendation

Either do:

solidity
if (upkeepIDs.length != topUpAmounts.length && topUpAmounts.length != registryAddresses.length) revert WrongParams();

or use an array of structs containing the 3 parameters.

Status

Addressed in #ae32282.