Audit finding: Currency ID validation missing
Project: ReefChain
Auditor: Halborn
Location: modules/currencies/src/lib.rs:125,178,186,199,217,235,290,303,316,324,336,376,386,394,402,423,445
Impact: 2
Likelihood: 2
Vulnerability class (Scout): Error Handling and Validation
Status: ACKNOWLEDGED: Reef states that there is only 1 currency id in use, and there likely won’t be more going forward.

3.5 (HAL-05) CURRENCY ID VALIDATION MISSING - LOW
Description:
Many dispatchables and helper methods defined in modules/currencies/src/lib.rs do not check if the user-supplied currency ID matches any of the existing ones before calling the possibly resource-intensive underlying utility functions.

Code Location:
Listing 8: modules/evm-accounts/src/lib.rs (Lines 125)
121 #[pallet::weight(T::WeightInfo::transfer_non_native_currency())]
122 pub fn transfer(
123 origin: OriginFor<T>,
124 dest: <T::Lookup as StaticLookup>::Source,
125 currency_id: CurrencyIdOf<T>,
126 #[pallet::compact] amount: BalanceOf<T>,
127 ) -> DispatchResultWithPostInfo {
128 let from = ensure_signed(origin)?;
129 let to = T::Lookup::lookup(dest)?;
130 <Self as MultiCurrency<T::AccountId>>::transfer(currency_id, &from, &to, amount)?;
131 Ok(().into())
132 }

List of all the functions that fail to validate the currency ID:
Listing 9: (Lines 2,3)
1 auditor@halborn:~/projects/reef/reef-chain/modules/currencies$ \
2 > grep -ne 'fn.*CurrencyId' src/lib.rs \
3 > | cut -d '-' -f 1
4 178: fn minimum_balance(currency_id: Self::CurrencyId)
5 186: fn total_issuance(currency_id: Self::CurrencyId)
6 199: fn total_balance(currency_id: Self::CurrencyId, who: &T::AccountId)
7 217: fn free_balance(currency_id: Self::CurrencyId, who: &T::AccountId)
8 235: fn ensure_can_withdraw(currency_id: Self::CurrencyId, who: &T::AccountId, amount: Self::Balance)
9 290: fn deposit(currency_id: Self::CurrencyId, who: &T::AccountId, amount: Self::Balance)
10 303: fn withdraw(currency_id: Self::CurrencyId, who: &T::AccountId, amount: Self::Balance)
11 316: fn can_slash(currency_id: Self::CurrencyId, who: &T::AccountId, amount: Self::Balance)
12 324: fn slash(currency_id: Self::CurrencyId, who: &T::AccountId, amount: Self::Balance)
13 336: fn update_balance(currency_id: Self::CurrencyId, who: &T::AccountId, by_amount: Self::Amount)
14 376: fn remove_lock(lock_id: LockIdentifier, currency_id: Self::CurrencyId, who: &T::AccountId)
15 386: fn can_reserve(currency_id: Self::CurrencyId, who: &T::AccountId, value: Self::Balance)
16 394: fn slash_reserved(currency_id: Self::CurrencyId, who: &T::AccountId, value: Self::Balance)
17 402: fn reserved_balance(currency_id: Self::CurrencyId, who: &T::AccountId)
18 423: fn reserve(currency_id: Self::CurrencyId, who: &T::AccountId, value: Self::Balance)
19 445: fn unreserve(currency_id: Self::CurrencyId, who: &T::AccountId, value: Self::Balance)

Risk Level:
Likelihood - 2
Impact - 2

Recommendations:
It is recommended to validate all user-supplied input in order to avoid executing unnecessary operations and mitigate the risk of resource exhaustion.

Remediation Plan:
ACKNOWLEDGED: Reef states that there is only 1 currency id in use, and there likely won’t be more going forward.

Summary: Missing validation for currency ID in multiple methods could lead to resource exhaustion.