Throughout the Curve contract, _minTargetAmount
and _maxOriginAmount
are used as open ranges (i.e., ranges that exclude the value itself).
This contravenes the standard meanings of the terms "minimum" and "maximum", which are generally used to describe closed ranges.
Short term, unless they are intended to be strict, make the inequalities in the require statements non-strict.
Alternatively, consider refactoring the variables or providing additional documentation to convey that they are meant to be exclusive bounds.
Long term, ensure that mathematical terms such as "minimum", "at least," and "at most" are used in the typical way-that is, to describe values inclusive of minimums or maximums (as relevant).
- ToB Audit DFX Finance Finding 2
- Specification
- max & min: Open Range
- Unorthodox Definitions
- Use Conventional Norms
- Document Otherwise