Pre-auditThree days of senior audit time for $1,500, credited in full toward your Zealynx audit.3 audit days, credited toward your auditSee how →
L-05·

Missing duplicate token validation in `setTargetWeight`

Not reportedoptionsleverageblack-scholes
TL;DR

The setTargetWeight function lacks validation for duplicate tokens in the input array, which could lead to inconsistent weight assignments.

Severity
LOW
Method
MManual review
CAT.

The setTargetWeight function lacks validation for duplicate tokens in the input array, which could lead to inconsistent weight assignments. Here's the problematic code:

solidity
function setTargetWeight(TokenWeight[] calldata tokens)
external
onlyRole(AccessControlStorage.DEFAULT_ADMIN_ROLE)
{
PoolStorage.AssetsConfig storage assets = PoolStorage.layout().setUp.assets;
uint256 nTokens = tokens.length;
if (nTokens != assets.allAssets.length()) revert PoolErrors.RequireAllTokens();
uint256 total;
TokenWeight memory item;
uint256 weight;
for (uint8 i; i < nTokens;) {
item = tokens[i];
assert(assets.allAssets.contains(item.token));
weight = assets.isListed[item.token] ? item.weight : 0;
assets.targetWeights[item.token] = weight;
total += weight;
// ... increment i
}
assets.totalWeight = total;
}

The issue arises because:

  1. The function only checks if the number of tokens matches assets.allAssets.length().
  2. There is no validation to ensure each token appears exactly once in the input array.
  3. If a token appears multiple times in the input array:
    • Each occurrence will overwrite the previous weight assignment.
    • Only the last occurrence's weight will be stored.
    • The totalWeight calculation will include all occurrences.

To mitigate this issue, it is recommended to add validation to ensure each token appears exactly once(by checking address ordering).

02Section · Report provenance

Report provenance

Published by Pashov Audit Group, with Carlos (Bloqarl) participating as a contractor. The source report states that its fixes review was not fully completed; no final remediation disposition is recorded for this finding. Read the full report.

L-05