compound-finance/comet

[L05] Missing validations

Closed this issue · 2 comments

There are some places in the code base that might benefit from some sanity checks on the input provided:

To reduce possible errors and make the code more rodust, consider adding sanity checks where needed.

There are arbitrarily many bad addresses that can be set, checking for the zero address seems like added complexity for little gain. In addition, while further checks in Comet.sol could be added, the contract is being optimized for efficiency and is up against a size limit, so we favor the current approach. The assumptions made by withdrawAndBorrowAmount and repayAndSupplyAmount are statically true of the contract.

In further testing, Kevin found that our assumptions for withdrawAndBorrowAmount and repayAndSupplyAmount are not in fact statically true, which he has patched here: #455