Omniscia Bluejay Finance Audit

BaseBondDepository Manual Review Findings

BaseBondDepository Manual Review Findings

BBD-01M: Inexistent Validation of Bond Existence

Description:

The _burn function does not validate that the bondId is a valid bond.

Example:

packages/contracts/contracts/BaseBondDepository.sol
29function _burn(uint256 bondId) internal {
30  address bondOwner = bondOwners[bondId];
31  uint256 lastBondIndex = ownedBonds[bondOwner].length - 1;
32  uint256 bondIndex = ownedBondsIndex[bondOwner][bondId];
33  if (bondIndex != lastBondIndex) {
34    uint256 lastBondId = ownedBonds[bondOwner][lastBondIndex];
35    ownedBonds[bondOwner][bondIndex] = lastBondId;
36    ownedBondsIndex[bondOwner][lastBondId] = bondIndex;
37  }
38  ownedBonds[bondOwner].pop();
39  delete ownedBondsIndex[bondOwner][bondId];
40  delete bonds[bondId];
41  delete bondOwners[bondId];
42}

Recommendation:

We advise a require check to be introduced ensuring that the bondOwner is non-zero thereby guaranteeing that the bond exists.

Alleviation:

The code now applies the owner validation as advised ensuring that inexistent bonds cannot be burned.

Prev

WhitelistSalePublic.sol (WSP-S)

Next

BluejayToken.sol (BTN-M)

On this page