sechub
HomeServicesAssetsJobsFindingsTicketsGovCheck
Guest Mode. Click here to sign in and access all features

    Stack to deep problems

    AGAVE: Deployment Security Audit

    Severity
    Informational
    Status
    Fixed
    Location(s)

    https://github.com/Agave-DAO/protocol-v2/blob/69cbb24fd849f3d0a93274bcda67fd5e2eda93f6/contracts/protocol/libraries/logic/ValidationLogic.sol#L120

    https://github.com/Agave-DAO/protocol-v2/blob/69cbb24fd849f3d0a93274bcda67fd5e2eda93f6/contracts/adapters/UniswapLiquiditySwapAdapter.sol#L130

    Description

    There are functions that go beyond the limits of the current code generator. The EVM stack only has 16 slots to fit local variables, parameters and/or return values. You can, of course, rely on having the optimizer turned on and circumvent the problem that way. However, some tools are not able to utilize the optimizer and can therefore not run. Tools that, for instance, help with deployment, compiling, analyzing, testing, fuzzing etc.

    Recommendation

    Move some of the parameters and variables to memory. You can also reduce the number of slots used by the parameters by grouping them into structs and making sure to utilize the right types. For instance, a slot can hold one uint256 or it could hold 32 uint8 as one uint8 only takes up one byte and one slot is 32 bytes. The same can be done with local variables. Note that some types take up more than one slot. Also, think about the design of the function. Does it really need all those parameters and variables? As a final note I would suggest taking a look at what Aave has done with these functions since it was forked as it seems they have corrected this error.

    NOTE, if you are not using functions like UniswapLiquiditySwapAdapter - swapAndDeposit, then just remove them as they are affecting the whole project.

    Comments
    No comments yet

    Stack to deep problems

    AGAVE: Deployment Security Audit

    Severity
    Informational
    Status
    Fixed