fix: validate withdrawal id in gateway

axieinfinity · Oct 16, 2023 · 610393f · 610393f
1 parent eb7ed08
commit 610393f
Showing 1 changed file with 5 additions and 0 deletions.
diff --git a/contracts/ronin/gateway/RoninGatewayV3.sol b/contracts/ronin/gateway/RoninGatewayV3.sol
@@ -266,6 +266,11 @@ contract RoninGatewayV3 is
     IBridgeTracking _bridgeTrackingContract = IBridgeTracking(getContract(ContractType.BRIDGE_TRACKING));
     for (uint256 _i; _i < withdrawals.length; ) {
       id = withdrawals[_i];
+
+      if (id == 0 || id > withdrawalCount) {
+        revert ErrInvalidRequest();
+      }
+
       _withdrawalSig[id][operator] = signatures[_i];
       _bridgeTrackingContract.recordVote(IBridgeTracking.VoteKind.Withdrawal, id, operator);