fix: Input validation for setAllowedSlippage (c4 #45)

maple-labs · Dec 12, 2021 · 3d62209 · 3d62209
1 parent b84aa00
commit 3d62209
Show file tree

Hide file tree

Showing 2 changed files with 15 additions and 1 deletion.
diff --git a/contracts/DebtLocker.sol b/contracts/DebtLocker.sol
@@ -82,7 +82,8 @@ contract DebtLocker is IDebtLocker, DebtLockerStorage, MapleProxied {
     }
 
     function setAllowedSlippage(uint256 allowedSlippage_) external override whenProtocolNotPaused {
-        require(msg.sender == _getPoolDelegate(), "DL:SAS:NOT_PD");
+        require(msg.sender == _getPoolDelegate(),   "DL:SAS:NOT_PD");
+        require(allowedSlippage_ <= uint256(10000), "DL:SAS:INVALID_SLIPPAGE");
 
         emit AllowedSlippageSet(_allowedSlippage = allowedSlippage_);
     }

diff --git a/contracts/test/DebtLocker.t.sol b/contracts/test/DebtLocker.t.sol
@@ -726,6 +726,19 @@ contract DebtLockerTests is TestUtils {
         pool.triggerDefault(address(debtLocker));
     }
 
+    /******************************/
+    /*** Input Validation Tests ***/
+    /******************************/
+
+    function test_setAllowedSlippage_invalidSlippage() external {
+        MapleLoan loan = _createLoan(1_000_000, 30_000);
+
+        DebtLocker debtLocker = DebtLocker(pool.createDebtLocker(address(dlFactory), address(loan)));
+
+        assertTrue(!poolDelegate.try_debtLocker_setAllowedSlippage(address(debtLocker), 10001));
+        assertTrue( poolDelegate.try_debtLocker_setAllowedSlippage(address(debtLocker), 10000));
+    }
+
     /***********************/
     /*** Refinance Tests ***/
     /***********************/