Submission Details
Severity:
Some cases might pass mulWadUp overflow check
Vulnerability Details
mul(y, gt(x, div(not(0), y)))is equivalent torequire(y == 0 || x <= type(uint256).max / y).mul(y, gt(x, or(div(not(0), y), x)))inmulWadUpwrap anorwhich might let some cases can pass overflow check.
Tools Used
Manual
Recommendations
- if mul(y, gt(x, or(div(not(0), y), x))) {
+ if mul(y, gt(x, div(not(0), y))) {
PoC
// @dev `forge test -vvvvv --force`
contract PoCTest is Test {
uint256 internal constant WAD = 1e18;
// error for mulWad and mulWadUp
error MulWadFailed();
// Reason: call did not revert as expected
function test_mulwadUp() external {
vm.expectRevert(MulWadFailed.selector);
MathMasters.mulWadUp(type(uint256).max, type(uint256).max);
}
}
Updates
Lead Judging Commences
inallhonesty almost 2 years ago
Submission Judgement Published Assigned finding tags:
`mulWadUp` has a bad overflow check
Rewards breakdown
nSLOC
46This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.