Description

In the function curveMultiExchange, the route and the swap parameters are verified within the route-hash computation and included in the proof verification. The pool argument defines the pool addresses, and the array is passed as an argument in _args.pools. This argument is not verified in the proof. This argument can be front-run and changed.

Impact

The pool address needs to be a valid pool address for the given token, but nevertheless, it may be changed for another pool the user did not choose. There is not a big margin for exploitation.

Recommendations

It can be added to the route-hash computation to enforce its verification.

Remediation

This issue has been acknowledged by Singularity, and a fix was implemented in commit 1c9f23e1↗.