The StoragePositions new function doesn't validate low and up parameters as it states it should

[howlbot-integration]

Lines of code

https://github.com/code-423n4/2024-08-superposition/blob/4528c9d2dbe1550d2660dac903a8246076044905/pkg/seawater/src/position.rs#L29-L39

Vulnerability details

Impact

Parameters could be passed with swapped places and the function will set them.

Proof of Concept

The comments suggest that the function requires the parameters to be in the correct places, but doesn't validate them, so the position can be created with swapped places of up and low price ticks.

Tools Used

Manual Review

Recommended Mitigation Steps

Consider making up and low mutable and swapping the parameters in the beginning of the function if low > up:

pub fn new(&mut self, id: U256, mut low: i32, mut up: i32) {
   if low > up {
      (low, up) = (up, low)
   };

Assessed type

Invalid Validation

[c4-judge]

alex-ppg changed the severity to 3 (High Risk)

[c4-judge]

alex-ppg marked the issue as partial-75