Insufficient input validation may lead to loss of funds due to invalid or malicious input data.

[c4-bot-8]

Lines of code

https://github.com/ronin-chain/katana-operation-contracts/blob/27f9d28e00958bf3494fa405a8a5acdcd5ecdc5d/src/aggregate-router/base/Dispatcher.sol#L50

Vulnerability details

Proof of Concept

Insufficient Input Validation: The contract relies on user-supplied data but does not adequately validate these inputs, such as recipient or amount. Malicious or erroneous inputs could result in unintended transactions or loss of funds.

Proof of Concept: If a user provides a 0x0 recipient address, funds could be sent to an invalid address, effectively burning them. Another example would be overly high values for slippage in swap functions (amountOutMin).
User calls dispatch with recipient set to 0x0.
Funds are transferred to a zero address, making them unrecoverable.

Impact: Loss of funds due to invalid or malicious input data.

Recommended Mitigation Steps

1. Validate recipient addresses and ensure they are not set to 0x0.
2. Set upper/lower bounds for amounts, slippage tolerances, and other sensitive parameters.
3. Implement sanity checks for other inputs to ensure they are within acceptable ranges.

Example:In Solidity, failing to validate addresses has led to several incidents of funds being sent to 0x0.

Assessed type

Invalid Validation

[nevillehuang]

Note, this are not present in the automated finding report for known issues. Grouping all address(0) input validation checks together. They should all likely be at most QA and argubly invalid based on the following READ.ME information:

Centralization risk. Sky Mavis is responsible for maintaining the Katana V3 contracts and will able to upgrade the contract if necessary, as well as specify additional fee tiers.

#101 would require a user error.

• Missing address(0) while initializing the PeripheryImmutableState in his constructor. #111
• Lack of address(0) in the KatanaGovernance::_setFactory function #107
• Missing address(0) check in the Payments::pay function. #101
• Insufficient input validation may lead to loss of funds due to invalid or malicious input data. #183