#46266 [SC-Insight] Cannot use a pool token suffix of MAX_SUFFIX_LEN

Submitted on May 27th 2025 at 14:47:51 UTC by @Oxgritty for Audit Comp | Flare | FAssets

• Report ID: #46266

• Report Type: Smart Contract

• Report severity: Insight

• Target: https://github.com/flare-foundation/fassets/blob/main/contracts/assetManager/library/AgentsCreateDestroy.sol

• Impacts:

Description

Brief/Intro

• When agent owner wants to create a vault, along with other parameters he also has to provide poolTokenSuffix, now the intended behaviour is that, its maximum length can be of MAX_SUFFIX_LEN but due to a logical error, agent owner can only provide a poolTokenSuffix of max length MAX_SUFFIX_LEN - 1.

Vulnerability Details

• For creating an agent createAgentVault function is called along with certain parameters of type AgentSettings.Data calldata _settings, inside _settings there is one parameter called _settings.poolTokenSuffix, now its max length can be of MAX_SUFFIX_LEN, but due the use of < instead of <=, its maximum allowed length is MAX_SUFFIX_LEN - 1.

Impact Details

• The maximum length allowed for poolTokenSuffix will be MAX_SUFFIX_LEN - 1, which is 1 less than the intended length.

References

• https://github.com/flare-foundation/fassets/blob/fc727ee70a6d36a3d8dec81892d76d01bb22e7f1/contracts/assetManager/library/AgentsCreateDestroy.sol#L249

Proof of Concept

Proof of Concept

1. Agent owner calls createAgentVault with _settings and length of _settings.poolTokenSuffix is equal to MAX_SUFFIX_LEN.

2. The code will revert in _reserveAndValidatePoolTokenSuffix due to following check:

        require(len < MAX_SUFFIX_LEN, "suffix too long");