# OstiumLinkUpKeep:topUp() is missing a length check for registryAddresses Low/Info · Three Sigma · RWA perpetuals DEX · 19th February, 2024 Finding 3S-OS-L11 of the Ostium security review. - Protocol: https://www.ostium.com/ - Report: /reports/ostium - Source: https://cdn.sanity.io/files/qoqld077/production/a95b9c69e0f65d1d6b0e649f0d62a362358ca8ce.pdf --- ### Description ```solidity OstiumLinkUpKeep:topUp() checks if (upkeepIDs.length != topUpAmounts.length) revert WrongParams();, but does not include the length of registryAddresses, which is ``` expected to be equal, as seen in [OstiumLinkUpKeep:getUnderfundedUpkeeps()](https://github.com/0xOstium/smart-contracts-threeSigma/blob/dev/src/OstiumLinkUpKeep.sol#L45). ### Recommendation Either do: ```solidity if (upkeepIDs.length != topUpAmounts.length && topUpAmounts.length != registryAddresses.length) revert WrongParams(); ``` or use an array of structs containing the 3 parameters. ### Status Addressed in [#ae32282](https://github.com/0xOstium/smart-contracts-threeSigma/pull/58/commits/ae322823fee80ff5807b2af95680d4896b89e5b1). --- Related findings: - [KeyringCoreV2Base::blacklistEntity() and KeyringCoreV2Base::unblacklistEntity() could check that the addresses are not already set](https://0xsimao.com/findings/keyring-ii-blacklist-entity-unblacklist-addresses): Keyring Credentials - [Anyone can get the NFT collateral token after an Auction without bidding due to missing check on msg.sender](https://0xsimao.com/findings/benddao-nft-collateral-auction-bidding): BendDAO - [`ManagedLeveragedVault::donateCollateral()` is missing a slippage check](https://0xsimao.com/findings/beraborrow-i-managed-donate-collateral-slippage): Beraborrow Managed Dens - [Missing key zero value check](https://0xsimao.com/findings/codeup-missing-key-zero-value): CODEUP