Assessment reportsPublic findings
Back to Zellic siteBack
↗
Assessment reports>InfiniCard Vault>Low findings>Unset state variable ,custodianList
GeneralOverview
Findings
Medium (1)
Low (3)Missing function to remove tokens from the whitelistUnset state variable custodianListMismatched function parameter types affecting inheritance
Informational (2)
DiscussionTypographical errorsLack of comprehensive test suite
Threat ModelWhat are threat models?BaseStrategyVault.solInfiniCardVault.solInfiniEthenaStrategyManager.solInfiniMorphoStrategyVault.sol
Audit ResultsAssessment Results
Category: Business Logic

Unset state variable custodianList

Low Impact
Low Severity
High Likelihood

Description

The contract InfiniCardController contains an array-type state variable, custodianList. Additionally, the contract InfiniCardVault includes the function getCustodianList, which reads and returns this array. However, there is no implementation to set the custodianList array value.

Impact

While there is a mapping variable that records the whitelist of custodians, the associated array custodianList remains empty. This inconsistency can lead to confusion and misalignment between the actual whitelist and the data returned by getCustodianList.

Recommendations

Consider updating the array custodianList in functions addCusdianToWhiteList and removeCusdianToWhiteList.

Remediation

This issue has been acknowledged by Infini Labs, and a fix was implemented in commit 0f710ced↗.

Zellic © 2025Back to top ↑