F-2024-0007·missing-validation
Lack of input parameter validation for amount parameters
TL;DR
Amount parameters in Points and Vault are not validated against zero. Zero-amount operations waste gas and can cause minor state inconsistencies.
Severity
LOW
Impact
LOW
Likelihood
LOW
Method
MManual review
CAT.
Complexity
LOW
Exploitability
LOW
02Section · Description
Description
The Points and Vault contracts lack input validation for several parameters, specifically ensuring that amount-related parameters (such as token amounts, fees, and rates) are within valid ranges. This oversight can lead to minor operational inefficiencies, unnecessary gas costs, and potential logical inconsistencies.
03Section · Impact
Impact
While the immediate impact of this lack of input validation is relatively low, it can lead to several issues:
- Operational Inefficiencies: Unchecked zero amounts can result in unnecessary transactions, consuming extra gas without performing meaningful operations.
- Minor Logical Inconsistencies: Functions performing actions with zero amounts might lead to minor inconsistencies or state changes that do not align with the intended logic.
- Usability Concerns: Incorrect fees or rates, if not validated, can make the contract less user-friendly or cause unexpected behaviors that may confuse users.
04Section · Recommendation
Recommendation
Implement input validation for these parameters to ensure they are different than zero.
solidity
if (amount == 0) revert("Amount should be different than zero");