# CurveAssetManagerHelper::_validateAssets() should check that the number of assets provided is smaller than the maximum of the pool Crit/High · Three Sigma · Private DeFi access · 26th February, 2024 Finding 3S-SG-H03 of the Singularity security review. - Protocol: https://www.thesingularity.network/ - Report: /reports/singularity - Source: https://cdn.sanity.io/files/qoqld077/production/45b8aac56a2b8e3b557df4329ac9bf8220b64012.pdf --- ### Description [CurveAssetManagerHelper::_validateAssets()](https://github.com/portalgateme/darkpool-v1-zk-contracts-fork/blob/master/contracts/defi/curve/CurveAssetManagerHelper.sol#L212) allows sending assets with indexes bigger than the maximum allowed of a pool (num_coins). This could lead to users losing tokens or unexpected behaviours. ### Recommendation Validate that the number of assets sent is at most num_coins. ### Status Addressed in [#8b300f0](https://github.com/portalgateme/darkpool-v1-zk-contracts-fork/commit/8b300f07a28f2c073154c8de3e9e90ba64ef1934). --- Related findings: - [Providing liquidity to the AMM does not check the return value of actually provided tokens leading to locked funds.](https://0xsimao.com/findings/cork-protocol-providing-actually-provided-locked): Cork Protocol - [All assets of (m)TapiocaOFT can be stealed by depositing to strategy cross chain call with 1 amount but maximum shares possible](https://0xsimao.com/findings/tapioca-dao-tapioca-stealed-maximum-shares): Tapioca DAO - [MapleGlobals, activatePoolManager() has no check that the pool manager is actually a valid pool manager.](https://0xsimao.com/findings/maple-finance-iii-globals-activate-actually-valid): Maple Finance - [`SyrupBitcoinRouter::requestRedeem()` could also check if the asset picked to redeem has liquidity](https://0xsimao.com/findings/maple-finance-iii-syrup-bitcoin-redeem-picked): Maple Withdrawal Queue