Skip to content
Request an audit

‹ Findings database

CurveAssetManagerHelper::_validateAssets() should check that the number of assets provided is smaller than the maximum of the pool

Crit/HighSingularity audit·Three Sigma·Private DeFi access·26th February, 20243S-SG-H03

Description

CurveAssetManagerHelper::_validateAssets() allows sending assets with indexes bigger than the maximum allowed of a pool (num_coins). This could lead to users losing tokens or unexpected behaviours.

Recommendation

Validate that the number of assets sent is at most num_coins.

Status

Addressed in #8b300f0.

Source

Disclosed by 0xSimao · Sherlock's 2025 Watson of the Year · 21 first places in 57 audit contests