Lack of input validation of arrays

[code423n4]

Handle

WatchPug

Vulnerability details

https://github.com/code-423n4/2021-10-mochi/blob/8458209a52565875d8b2cefcb611c477cefb9253/projects/mochi-core/contracts/profile/MochiProfileV0.sol#L82-L89

function changeAssetClass(
        address[] calldata _assets,
        AssetClass[] calldata _classes
    ) external override onlyGov {
        for (uint256 i = 0; i < _assets.length; i++) {
            _assetClass[_assets[i]] = _classes[i];
        }
    }

If the array length of _assets is larger than the length of _classes, when accessing _assets[i] it will throw an out-of-range exception.

Other instances include:

https://github.com/code-423n4/2021-10-mochi/blob/8458209a52565875d8b2cefcb611c477cefb9253/projects/mochi-core/contracts/profile/MochiProfileV0.sol#L91-L98

function changeCreditCap(
    address[] calldata _assets,
    uint256[] calldata _caps
) external onlyGov {
    for (uint256 i = 0; i < _assets.length; i++) {
        creditCap[_assets[i]] = _caps[i];
    }
}

https://github.com/code-423n4/2021-10-mochi/blob/8458209a52565875d8b2cefcb611c477cefb9253/projects/mochi-cssr/contracts/adapter/ChainlinkAdapter.sol#L33-L37

function setFeed(address[] calldata _assets, address[] calldata _feeds) external onlyGov {
    for(uint256 i = 0; i<_assets.length; i++) {
        feed[_assets[i]] = AggregatorV3Interface(_feeds[i]);
    }
}

Recommendation

Consider adding checks for input validation of arrays.

For example:

function changeAssetClass(
    address[] calldata _assets,
    AssetClass[] calldata _classes
) external override onlyGov {
    require(_assets.length == _classes.length, "INVALID_ARRAYS");
    for (uint256 i = 0; i < _assets.length; i++) {
        _assetClass[_assets[i]] = _classes[i];
    }
}

[r2moon]

duplicated with #31

[ghoul-sol]

best practices