wrong implement of getPositionsForCurator

[howlbot-integration]

Lines of code

https://github.com/code-423n4/2024-08-phi/blob/main/src/Cred.sol#L513

Vulnerability details

Impact

Detailed description of the impact of this finding.

wrong implement of getPositionsForCurator as we are doing
credIds[i] = credId;
@> amounts[i] = amount;

instead of credIds[index] = credId;
@> amounts[index] = amount;

Proof of Concept

Provide direct links to all referenced code in GitHub. Add screenshots, logs, or any other relevant proof that illustrates the concept.

function getPositionsForCurator(
address curator_,
uint256 start_,
uint256 stop_
)
external
view
returns (uint256[] memory credIds, uint256[] memory amounts)
{
uint256[] storage userCredIds = credIdsPerAddress[curator];

    uint256 stopIndex;
    if (userCredIds.length == 0) {
        return (credIds, amounts);
    }
    if (stop_ == 0 || stop_ > userCredIds.length) {
        stopIndex = userCredIds.length;
    } else {
        stopIndex = stop_;
    }

    if (start_ >= stopIndex) {
        revert InvalidPaginationParameters();
    }

    credIds = new uint256[](stopIndex - start_);
    amounts = new uint256[](stopIndex - start_);

    uint256 index = 0;
    for (uint256 i = start_; i < stopIndex; i++) {
        uint256 credId = userCredIds[i];
        if (_credIdExistsPerAddress[curator_][credId]) {
            uint256 amount = shareBalance[credId].get(curator_);
          @>  credIds[i] = credId;
          @>  amounts[i] = amount;
            index++;
        }
    }
    // Resize the result array to remove unused slots
    assembly {
       mstore(credIds, index)
       mstore(amounts, index)
    }
}

Tools Used

Recommended Mitigation Steps

function getPositionsForCurator(
address curator_,
uint256 start_,
uint256 stop_
)
external
view
returns (uint256[] memory credIds, uint256[] memory amounts)
{
uint256[] storage userCredIds = credIdsPerAddress[curator];

    uint256 stopIndex;
    if (userCredIds.length == 0) {
        return (credIds, amounts);
    }
    if (stop_ == 0 || stop_ > userCredIds.length) {
        stopIndex = userCredIds.length;
    } else {
        stopIndex = stop_;
    }

    if (start_ >= stopIndex) {
        revert InvalidPaginationParameters();
    }

    credIds = new uint256[](stopIndex - start_);
    amounts = new uint256[](stopIndex - start_);

    uint256 index = 0;
    for (uint256 i = start_; i < stopIndex; i++) {
        uint256 credId = userCredIds[i];
        if (_credIdExistsPerAddress[curator_][credId]) {
            uint256 amount = shareBalance[credId].get(curator_);
        @>    credIds[index] = credId;
        @>    amounts[index] = amount;
            index++;
        }
    }
    // Resize the result array to remove unused slots
    assembly {
        mstore(credIds, index)
        mstore(amounts, index)
    }
}

Assessed type

Context

[c4-judge]

fatherGoose1 marked the issue as satisfactory

[c4-judge]

fatherGoose1 changed the severity to QA (Quality Assurance)

[c4-judge]

fatherGoose1 marked the issue as grade-a