First Flight #8: Math Master
First Flight #8
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: low
Valid

`MathMasters.sol::mulWad()` and `MathMasters.sol::mulWadUp()` functions revert with the non-intended custom error selector

stefanlatinovic

Summary

The function selector, functions are reverting with, is not the intended one of the error MathMasters__MulWadFailed().

Vulnerability Details

Both functions are indicating that in case of overflow, they will revert with the function selector of the error MathMasters__MulWadFailed(), but instead of that they revert with the function selector of the MulWadFailed() error located in the Solady library (https://github.com/vectorized/solady/blob/main/src/utils/FixedPointMathLib.sol#L69).

Impact

Business logic in third-party contracts may depend on matching the reverted reason with the function selector of the error MathMasters__MulWadFailed(), which could lead to unexpected results if the error is not successfully caught and properly handled.

Proof of Concept (PoC)

With the command cast sig, we can find the function selector of any function or custom error.

Executing cast sig "MathMasters__MulWadFailed()" shows that the output is 0xa56044f7, a function selector different from the one used in the codebase (0xbac65e5b).

Tools Used

  • Manual review

  • Foundry

    • cast

Recommendations

We should replace the function selector 0xbac65e5b with the function selector of the error MathMasters__MulWadFailed(), which is 0xa56044f7.

Recommended changes to the MathMasters.sol::mulWad() function:

function mulWad(uint256 x, uint256 y) internal pure returns (uint256 z) {
// @solidity memory-safe-assembly
assembly {
// Equivalent to `require(y == 0 || x <= type(uint256).max / y)`.
if mul(y, gt(x, div(not(0), y))) {
- mstore(0x40, 0xbac65e5b) // `MathMasters__MulWadFailed()`.
+ mstore(0x40, 0xa56044f7) // `MathMasters__MulWadFailed()`.
revert(0x1c, 0x04)
}
z := div(mul(x, y), WAD)
}
}

Recommended changes to the MathMasters.sol::mulWadUp() function:

function mulWadUp(uint256 x, uint256 y) internal pure returns (uint256 z) {
/// @solidity memory-safe-assembly
assembly {
// Equivalent to `require(y == 0 || x <= type(uint256).max / y)`.
if mul(y, gt(x, or(div(not(0), y), x))) {
- mstore(0x40, 0xbac65e5b) // `MathMasters__MulWadFailed()`.
+ mstore(0x40, 0xa56044f7) // `MathMasters__MulWadFailed()`.
revert(0x1c, 0x04)
}
if iszero(sub(div(add(z, x), y), 1)) { x := add(x, 1) }
z := add(iszero(iszero(mod(mul(x, y), WAD))), div(mul(x, y), WAD))
}
}
Updates

Lead Judging Commences

inallhonesty Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

Wrong error selector

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.