L-05·
Missing duplicate token validation in `setTargetWeight`
TL;DR
The setTargetWeight function lacks validation for duplicate tokens in the input array, which could lead to inconsistent weight assignments.
Severity
LOW
Method
MManual review
CAT.
The setTargetWeight function lacks validation for duplicate tokens in the input array, which could lead to inconsistent weight assignments. Here's the problematic code:
solidity
function setTargetWeight(TokenWeight[] calldata tokens)externalonlyRole(AccessControlStorage.DEFAULT_ADMIN_ROLE){PoolStorage.AssetsConfig storage assets = PoolStorage.layout().setUp.assets;uint256 nTokens = tokens.length;if (nTokens != assets.allAssets.length()) revert PoolErrors.RequireAllTokens();uint256 total;TokenWeight memory item;uint256 weight;for (uint8 i; i < nTokens;) {item = tokens[i];assert(assets.allAssets.contains(item.token));weight = assets.isListed[item.token] ? item.weight : 0;assets.targetWeights[item.token] = weight;total += weight;// ... increment i}assets.totalWeight = total;}
The issue arises because:
- The function only checks if the number of tokens matches assets.allAssets.length().
- There is no validation to ensure each token appears exactly once in the input array.
- If a token appears multiple times in the input array:
- Each occurrence will overwrite the previous weight assignment.
- Only the last occurrence's weight will be stored.
- The
totalWeightcalculation will include all occurrences.
To mitigate this issue, it is recommended to add validation to ensure each token appears exactly once(by checking address ordering).
02Section · Report provenance
Report provenance
Published by Pashov Audit Group, with Carlos (Bloqarl) participating as a contractor. The source report states that its fixes review was not fully completed; no final remediation disposition is recorded for this finding. Read the full report.