Reco-3: add checks for parameters in function callTargets (#82)

Co-authored-by: ksatyarth2 <ksatyarth2@users.noreply.github.com>

mainnet-contracts/src/PufferRevenueDepositor.sol

@@ -153,6 +153,10 @@ contract PufferRevenueDepositor is
      * @dev Restricted access to `ROLE_ID_OPERATIONS_MULTISIG`
      */
     function callTargets(address[] calldata targets, bytes[] calldata data) external restricted {
+        if (targets.length != data.length || targets.length == 0) {
+            revert InvalidDataLength();
+        }
+
         for (uint256 i = 0; i < targets.length; ++i) {
             // nosemgrep arbitrary-low-level-call
             (bool success,) = targets[i].call(data[i]);

mainnet-contracts/src/interface/IPufferRevenueDepositor.sol

@@ -7,6 +7,11 @@ pragma solidity >=0.8.0 <0.9.0;
  * @custom:security-contact security@puffer.fi
  */
 interface IPufferRevenueDepositor {
+    /**
+     * @notice Thrown when the calldata targets and data length don't match or are empty.
+     */
+    error InvalidDataLength();
+
     /**
      * @notice Thrown when the target call fails.
      */

mainnet-contracts/test/unit/PufferRevenueDepositorTest.t.sol

@@ -202,4 +202,24 @@ contract PufferRevenueDepositorTest is UnitTestHelper {
         emit IPufferRevenueDepositor.RevenueDeposited(100 ether);
         revenueDepositor.callTargets(targets, data);
     }
+
+    function testRevert_callTargets_InvalidDataLength_EmptyArrays() public {
+        vm.startPrank(OPERATIONS_MULTISIG);
+
+        address[] memory targets = new address[](0);
+        bytes[] memory data = new bytes[](0);
+
+        vm.expectRevert(IPufferRevenueDepositor.InvalidDataLength.selector);
+        revenueDepositor.callTargets(targets, data);
+    }
+
+    function testRevert_callTargets_InvalidDataLength_MismatchedLengths() public {
+        vm.startPrank(OPERATIONS_MULTISIG);
+
+        address[] memory targets = new address[](2);
+        bytes[] memory data = new bytes[](1);
+
+        vm.expectRevert(IPufferRevenueDepositor.InvalidDataLength.selector);
+        revenueDepositor.callTargets(targets, data);
+    }
 }