Zellic - Audit Reports

The `executeRoute` does not revert on unsupported function selector

The executeRoute function processes hops data, which specifies the necessary details for executing multiple functions in sequence. However, when an unsupported function selector is provided, the function does not revert but instead proceeds to the next hop.

We recommend modifying the executeRoute function to explicitly revert when encountering an unsupported function selector. This will ensure that any invalid input is properly handled, maintaining the expected execution flow.

function executeRoute(
    [...]
) external override {
    RouteMetadata memory route;

    if (settlement == ICLOB.Settlement.INSTANT && bytes4(hops[0][0:4]) == this.executeClobPostFillOrder.selector) {
        clobFactory.deposit(msg.sender, tokenIn, amountIn, false);
    } else if (settlement == ICLOB.Settlement.INSTANT) {
        tokenIn.safeTransferFrom(msg.sender, address(this), amountIn);
    } else if (bytes4(hops[0][0:4]) == this.executeUniV2SwapExactTokensForTokens.selector) { 
        clobFactory.withdraw(msg.sender, tokenIn, amountIn, true);
    }

    [...]

    for (uint256 i = 0; i < hops.length; i++) {
        bytes4 currSelector = bytes4(hops[i][0:4]);
        route.nextSelector = i == hops.length - 1 ? bytes4(0) : bytes4(hops[i + 1][0:4]);

        if (currSelector == this.executeClobPostFillOrder.selector) {
            (route.prevAmountOut, route.nextTokenIn) = _executeClobPostFillOrder(route, hops[i]);
        } else if (currSelector == this.executeUniV2SwapExactTokensForTokens.selector) {
            (route.prevAmountOut, route.nextTokenIn) = _executeUniV2SwapExactTokensForTokens(route, hops[i]);
        }

        route.prevSelector = currSelector;
    }

    [...]
}

This issue has been acknowledged by Liquid Labs, Inc., and a fix was implemented in commit 2bc39fcf↗.

Liquid Labs, Inc. provided the following response:

This commit adds a revert to route dispatching if the selector is not recognized

The executeRoute does not revert on unsupported function selector

The `executeRoute` does not revert on unsupported function selector