Exposure.sortVaultsByDelta does not work for N_COINS != 3

[code423n4]

Handle

cmichel

Vulnerability details

Vulnerability Details

The Exposure.sortVaultsByDelta function computes the missing vault index from the min and max vault indices by:

vaultIndexes[1] = N_COINS - maxIndex - minIndex;

This only works for N_COINS = 3.

Impact

If any new stablecoin is ever removed or added, this function will break.

Recommended Mitigation Steps

Never change the number of stablecoins and consider adding an assert(N_COINS == 3) here.

[kitty-the-kat]

non-critical: By its nature, exposure and allocations should be redeployed if any fundamental changes are done to the underlying exposure types

[ghoul-sol]

In summary, works as designed. Non-critical.