Description

There are two types of markets for fixed term and fixed expiry bonds. The maximum vesting value for fixed term bonds is 50 years, but actually there are not any checks of the input params_.vesting value; therefore, the market creator can set greater value than the maximum.

Impact

A market created with a larger than expected vesting value is invalid, and it can cause unexpected behavior for this market. For example, the isInstantSwap function will define this market as an instant swap market and return true value.

Recommendations

Add validation of the input params_.vesting value.

Remediation

Bond Labs acknowledged this finding and implemented a fix in commit 0538adb3↗.