Insufficient input validation may lead to loss of funds due to invalid or malicious input data.

[howlbot-integration]

Lines of code

https://github.com/ronin-chain/katana-operation-contracts/blob/27f9d28e00958bf3494fa405a8a5acdcd5ecdc5d/src/aggregate-router/base/Dispatcher.sol#L50

Vulnerability details

Proof of Concept

Insufficient Input Validation: The contract relies on user-supplied data but does not adequately validate these inputs, such as recipient or amount. Malicious or erroneous inputs could result in unintended transactions or loss of funds.

Proof of Concept: If a user provides a 0x0 recipient address, funds could be sent to an invalid address, effectively burning them. Another example would be overly high values for slippage in swap functions (amountOutMin).
User calls dispatch with recipient set to 0x0.
Funds are transferred to a zero address, making them unrecoverable.

Impact: Loss of funds due to invalid or malicious input data.

Recommended Mitigation Steps

1. Validate recipient addresses and ensure they are not set to 0x0.
2. Set upper/lower bounds for amounts, slippage tolerances, and other sensitive parameters.
3. Implement sanity checks for other inputs to ensure they are within acceptable ranges.

Example:In Solidity, failing to validate addresses has led to several incidents of funds being sent to 0x0.

Assessed type

Invalid Validation

[khangvv]

Transfers to the zero address are a user preference; users should be free to transfer to any address they choose. If this is a suggestion for best practices (maybe in the QA report?), I still respectfully disagree. As Katana is a DEX intended to work with standard ERC20 tokens, the logic for allowing or prohibiting transfers to the zero address should be managed by the token contract itself.

[alex-ppg]

The Warden outlines that insufficient input validation is applied on dispatch interactions, however, they are meant to be permissionless and no input sanitization is meant to be applied to them given that the Ronin AMM is a DEX implementation.

[c4-judge]

alex-ppg marked the issue as unsatisfactory:
Invalid