Steadefi
Steadefi
DeFiHardhatFoundryOracle
35,000 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

Implicit Data Type Conversion from uint256 to int256

0xVinylDavyl

Vulnerability Details

The GMXOracle contract exhibits implicit data type conversion in certain parts of its code. This implicit conversion can lead to unexpected results when manipulating data, as the data types may not align as expected.

Vulnerability Location

One of the examples of implicit data type conversion occurs in the getAmountsIn function of the GMXOracle contract, where an implicit conversion from uint256 to int256 can potentially result in unexpected results. Below is the vulnerable function:

/**
* @notice Helper function to calculate amountIn of either long or short token for swapping for
* desired amountsOut of long or short token
* @notice We utilize GMX's getSwapAmountOut() with tokenOut being tokenIn, multiplying
* the amountsOut value by 1.0015x to account for fees and normal Chainlink price feed differential
* @param marketToken LP token address
* @param indexToken Index token address
* @param longToken Long token address
* @param shortToken Short token address
* @param tokenOut TokenIn address
* @param amountsOut AmountsOut of tokenOut, expressed in tokenOut's decimals
* @return amountsOut Amount of tokenIn to be swapped, expressed in tokenIn's decimals
*/
function getAmountsIn(
address marketToken,
address indexToken,
address longToken,
address shortToken,
address tokenOut,
uint256 amountsOut
) public view returns (uint256) {
return getAmountsOut(
marketToken,
indexToken,
longToken,
shortToken,
tokenOut,
amountsOut
) * (1e18 + 15e14) / SAFE_MULTIPLIER;
}

There is an implicit data type conversion when multiplying getAmountsOut by (1e18 + 15e14) to calculate amountsIn. This can lead to unexpected results as getAmountsOut returns a uint256, while the other values in the multiplication are of type int256.

Impact

The implicit data type conversion can lead to unexpected results when performing calculations, potentially affecting the accuracy and reliability of the contract's functions. It may result in erroneous calculations and financial losses.

Tools Used

Manual

Recommendations

To mitigate this vulnerability, it is recommended to handle data type conversions explicitly. Ensure that the data types of variables involved in mathematical operations align correctly to prevent unexpected results.

Updates

Lead Judging Commences

hans Lead Judge almost 2 years ago
Submission Judgement Published
Invalidated
Reason: Lack of quality

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.