stake.link

Summary

casting from uint256 to int256 values existed without check for overflow

Vulnerability Details

Unsafe casting from uint256 to int256 is carried out without any check for overflow as uint256 has greater value than int256
Multiple instances of explicit casting between types exist in contract SDLPoolSecondary, with both having the potential to impart overflow errors when casting between int256 and uint256.

Impact

The issue is with casting that is carried out to an int and then negated in function of _executeQueuedLockUpdates on line#465 and 466.
However, since uint256 have higher storage values than int256, it is possible that casting from uint to int may create an overflow.

Tools Used

Manual Review

Recommended Mitigation Steps

The recommendation is made for using the OpenZeppelin’s SafeCast library to provide overflow checking when casting from one type of number to another.