Summary

The MathMasters::mulWadUp function performs a multiplication operation on two unsigned integers and returns the result as a fixed-point number, rounded up. However, there is an issue with the rounding logic that lead to incorrect results under certain conditions.

Vulnerability Details

The rounding logic in the mulWadUpv function is based on the condition if iszero(sub(div(add(z, x), y), 1)) { x := add(x, 1) }```. This condition checks if the sum of z and x divided by y minus 1 is zero. If it is, it increments x by 1. However, this logic isn't correct. The issue arises from the fact that the variable z is used before it's actually calculated.
In the code, z is used in the calculation div(add(z, x), y) before it's assigned a value. This is problematic because z is supposed to hold the result of the multiplication and division operation, but at this point in the code, it hasn't been assigned yet. As a result, the calculation doesn't behave as expected, leading to incorrect results.

Impact

The rounding logic is flawed, it leads to incorrect results when the mulWadUp function is used. This affects any functionality in any the application that relies on this function.

Run this test using:
runs = 1000000
in the foundry.toml

Tools Used

Manual review

Recommendations

To fix this issue, we could modify the rounding logic to ensure it handles all edge cases correctly. One way to do this is to always round up if there's a remainder after the division, regardless of whether the sum of z and x divided by y minus 1 is zero. Here's how you could implement this:

If you run the test again it passes.