H-01 MitigationConfirmed

[code423n4]

Lines of code

Vulnerability details

Issue seems to be resolved, since a token/collateral wouldn’t be added to the erc20All/collsAll array unless they’re a registered asset.
This will ensure that the len will never exceed (or reach, to be more precise) assetRegistry.size() and therefore there’s no longer a risk of index out of bounds error.
The solution costs some extra gas as noted in my comment on the original issue
The catch block uses the check that it’s not an out of gas error, as said in the past an empty error can be due to other errors. But in this case the logic of toAsset() is rather simple and there doesn’t seem to be a case where an empty error would be raised for other reasons than gas.

[c4-judge]

0xean marked the issue as satisfactory