The Standard
The Standard
DeFiHardhat
20,000 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

Integer Overflow if there is a large number of holders

mylifechangefast

Summary

In the given code snippet for the distributeFees function, there is a potential risk of integer overflow during the calculation of positions[_holder].EUROs += _amount * positions[_holder].TST / tstTotal within the loop iterating over holders. If the product of _amount * positions[_holder].TST exceeds the maximum value that a uint256 can hold, an overflow may occur.

Vulnerability Details

function distributeFees(uint256 _amount) external onlyManager {
uint256 tstTotal = getTstTotal();
if (tstTotal > 0) {
IERC20(EUROs).safeTransferFrom(msg.sender, address(this), _amount);
for (uint256 i = 0; i < holders.length; i++) {
address _holder = holders[i];
positions[_holder].EUROs += _amount * positions[_holder].TST / tstTotal;
}
for (uint256 i = 0; i < pendingStakes.length; i++) {
pendingStakes[i].EUROs += _amount * pendingStakes[i].TST / tstTotal;
}
}
}

POC

uint256 constant MAX_UINT256 = type(uint256).max;
​
// Function that may cause an overflow
function simulateOverflow() external pure returns (uint256) {
uint256 _amount = MAX_UINT256;
uint256 holderTST = 2;
​
// This multiplication may cause an overflow
uint256 result = _amount * holderTST;
​
return result;
}

In this example, we set _amount to the maximum representable value of a uint256, which is 2^256 - 1. If holderTST is a sufficiently large value, the multiplication operation _amount * holderTST may exceed the maximum representable value for a uint256, causing an integer overflow.

positions[_holder].TST is a large value, the multiplication _amount * positions[_holder].TST could potentially lead to an overflow, especially when _amount is set to the maximum representable value. The subsequent addition in positions[_holder].EUROs += holderShare might then cause an unexpected result due to the overflow.

Impact

https://github.com/Cyfrin/2023-12-the-standard/blob/91132936cb09ef9bf82f38ab1106346e2ad60f91/contracts/LiquidationPool.sol#L192
https://github.com/Cyfrin/2023-12-the-standard/blob/91132936cb09ef9bf82f38ab1106346e2ad60f91/contracts/LiquidationPool.sol#L188

Tools Used

Manual Review

Recommendations

Use safeMath Library

Updates

Lead Judging Commences

hrishibhat Lead Judge almost 2 years ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

informational/invalid

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.