Skip to content
Request an audit

‹ All findings

CurveAssetManagerHelper::_validateAssets() should check that the number of assets provided is smaller than the maximum of the pool

Crit/HighSingularity·Three Sigma · Private DeFi access · 26th February, 20243S-SG-H03

ReportSource

Description

CurveAssetManagerHelper::_validateAssets() allows sending assets with indexes bigger than the maximum allowed of a pool (num_coins). This could lead to users losing tokens or unexpected behaviours.

Recommendation

Validate that the number of assets sent is at most num_coins.

Status

Addressed in #8b300f0.