Omniscia rain protocol Audit
ValueTier Manual Review Findings
ValueTier Manual Review Findings
VTR-01M: Inexistent Enforcement of Tier Value Validity
Type | Severity | Location |
---|---|---|
Input Sanitization | ValueTier.sol:L32, L67 |
Description:
The tierValues_
supplied to the contract during its initialization are meant to be in ascending format based on the implementation of valueToTier
, however, no such guarantee is imposed by the contract.
Example:
contracts/tier/ValueTier.sol
31/// Set the `tierValues` on construction to be referenced immutably.32function initializeValueTier(uint256[8] memory tierValues_) internal {33 // Reinitialization is a bug.34 assert(tierValuesPointer == address(0));35 address tierValuesPointer_ = SSTORE2.write(abi.encode(tierValues_));36 emit InitializeValueTier(msg.sender, tierValuesPointer_);37 tierValuesPointer = tierValuesPointer_;38}39
40/// Complements the default solidity accessor for `tierValues`.41/// Returns all the values in a list rather than requiring an index be42/// specified.43/// @return tierValues_ The immutable `tierValues`.44function tierValues() public view returns (uint256[8] memory tierValues_) {45 return abi.decode(SSTORE2.read(tierValuesPointer), (uint256[8]));46}47
48/// Converts a Tier to the minimum value it requires.49/// tier 0 is always value 0 as it is the fallback.50/// @param tier_ The Tier to convert to a value.51function tierToValue(uint256[8] memory tierValues_, uint256 tier_)52 internal53 pure54 returns (uint256)55{56 return tier_ > TierConstants.TIER_ZERO ? tierValues_[tier_ - 1] : 0;57}58
59/// Converts a value to the maximum Tier it qualifies for.60/// @param value_ The value to convert to a tier.61function valueToTier(uint256[8] memory tierValues_, uint256 value_)62 internal63 pure64 returns (uint256)65{66 for (uint256 i_ = 0; i_ < TierConstants.MAX_TIER; i_++) {67 if (value_ < tierValues_[i_]) {68 return i_;69 }70 }71 return TierConstants.MAX_TIER;72}
Recommendation:
We advise the tierValues_
to be sanitized in the initializeValueTier
function to ensure they are in ascending order.
Alleviation:
The initialization code was updated to properly evaluate that the tier values are in ascending order thereby alleviating this exhibit.