Submission Details
Severity:
Lack of safe downcasting used in certain places
Summary
There is a lack of safe downcasting used throughout the protocol. This can potentially result in overflows during edge cases, which should not be allowed.
Vulnerability Details
In the BridgeRouterFacet there is the following line of code:
uint88 zethAmount = uint88(IBridge(bridge).deposit(msg.sender, amount))
The return value of deposit is uint256, but we downcast it to uint88, which is not safe.
Impact
Overflows during downcasting can result in invalid logic being run.
Tools Used
Manual review
Recommendations
When downcasting use a library which enforces safe downcasting to ensure there are no overflows.
Prize pool breakdown
Total prize
55,000 USDC
nSLOC
3,36516 USDC / LOC
50,000 USDC
5,000 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.