Assessment reports>ZetaChain>Discussion>Missing validation

Missing validation

Code maturity is a critical aspect of high-assurance projects. By implementing checks, we can protect against potential mishaps, reduce the risk of lost funds or frozen protocols, and improve user experience. In addition, adding extra error messages can help clarify the internal mechanisms and reduce potential bugs that future developers might introduce while building on this project.

  • keeper_cross_chain_tx_vote_outbound_tx.go: VoteOnObservedOutboundTx - There is no check that the observationChain is not nil, which will cause a panic. During the normal operation, the chain should always exist, but since the IsAuthorized check uses the observationChain, it is possible for anyone to trigger it by sending a MsgVoteOnObservedOutboundTx message. The panic is handled by the default recovery middleware but would be better to explicitly check for nil and return an error.

  • btc_signer.go: SignWithdrawTx - The value of the out transaction is calculated with remainingSatoshis - fees, but there is no guarantee that remainingSatoshis is greater than the fees, which would result in a negative value and the transaction failing. It would be better to explicitly check for this case and return an error indicating what has happened.

Zellic © 2024Back to top ↑