Summary

logic flaw in mulWadUp function cause producing wrong results in certain cases.

Vulnerability Details

Library MathMasters contains a given function

The given function is used to return ( x * y ) / WAD rounded up. With current code it does so in most cases.
if we check line if mul(y, gt(x, or(div(not(0), y), x))) . It has or operation which will cause to overflow the multiplication of (x * y).
Let's check the other marked line if iszero(sub(div(add(z, x), y), 1)) { x := add(x, 1) }, it

• add(z, x): Adds the values of z and x.

• div(add(z, x), y): Divides the result of the addition by the value of y.

• sub(div(add(z, x), y), 1): Subtracts 1 from the result of the division.

• iszero(...): Checks if the result of the subtraction is zero.

• if iszero(...) { x := add(x, 1) }: If the result is zero, it increments the value of x by 1.

This statement cause issue to final result in many cases, which can be verified via fuzz testing.
it fails miserably when we do fuzz testing.

POC

In foundry.toml update the fuzz runs to 1000000
let's test if reverts when (x * y) overflows.

In existing testsuite, write following test

run forge test --mt testOverFlowInMulWadUp -vv in your terminal and it will print following results.

then run forge --mt testMulWadFuzz -vv in your terminal, to test the scenarios where it fails to hold condition
uint256 expected = x * y == 0 ? 0 : (x * y - 1) / 1e18 + 1

results shows like this --

we run test again, just to double confirm
we get

Impact

Wrong results will lead to make this library useless and projects which using this can have loss of funds

Tools Used

Foundry, Manual Review

Recommendations

Here is the updated snippet to fix the code