Unchecked Array Access in Locker.sol

[sirius651]

https://github.com/Steemhunt/mint.club-v2-contract/blob/main/contracts/Locker.sol#L87

/**
     * @dev Unlocks the tokens of a lock-up.
     * @param lockUpId The ID of the lock-up.
     */
    function unlock(uint256 lockUpId) external onlyReceiver(lockUpId) {
        LockUp storage lockUp = lockUps[lockUpId];
        if (lockUp.unlocked) revert LockUp__AlreadyClaimed();
        if (lockUp.unlockTime > block.timestamp) revert LockUp__NotYetUnlocked();

        lockUp.unlocked = true;

        if (lockUp.isERC20) {
            IERC20(lockUp.token).safeTransfer(lockUp.receiver, lockUp.amount);
        } else {
            IERC1155(lockUp.token).safeTransferFrom(address(this), lockUp.receiver, 0, lockUp.amount, "");
        }

        emit Unlocked(lockUpId, lockUp.token, lockUp.isERC20, lockUp.receiver, lockUp.amount);
    }

In the onlyReceiver modifier and the unlock function, there's unchecked access to the lockUps array using lockUps[lockUpId]. This can lead to a revert due to an out-of-bounds error if lockUpId is not a valid index. To resolve this, you need to validate that lockUpId is within the bounds of the lockUps array.

[sirius651]

in this first PR, here's my address : 0x1CdEBe3d073CE76615Ed3f9FaB9F4A886BE62f27

[sydneyitguy]

I guess reverting with an out-of-bounds error here is expected. Are there any security issues with that?

[Tech-Icons]

Out-of-bound errors means you're probably not accessing indices right, so check which of your data structures are vulnerable to that.
Study the error message you get because that at least shows the line where the error happens

0x7F60eCB087eF0b852C19d5248b57e472F7066B5C

[0x3agle]

An out-of-bound error doesn't mean "not accessing indices right". It means you are trying to access something that's not there. It's the input problem.

I don't think it's a security issue.

[sydneyitguy]

@0x3agle, agreed. I will close this issue as invalid.