First Flight #8: Math Master
First Flight #8
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Some cases might pass mulWadUp overflow check

wiasliaw

Vulnerability Details

  • mul(y, gt(x, div(not(0), y))) is equivalent to require(y == 0 || x <= type(uint256).max / y).

  • mul(y, gt(x, or(div(not(0), y), x))) in mulWadUp wrap an or which might let some cases can pass overflow check.

Tools Used

Manual

Recommendations

- if mul(y, gt(x, or(div(not(0), y), x))) {
+ if mul(y, gt(x, div(not(0), y))) {

PoC

// @dev `forge test -vvvvv --force`
contract PoCTest is Test {
uint256 internal constant WAD = 1e18;
​
// error for mulWad and mulWadUp
error MulWadFailed();
​
// Reason: call did not revert as expected
function test_mulwadUp() external {
vm.expectRevert(MulWadFailed.selector);
MathMasters.mulWadUp(type(uint256).max, type(uint256).max);
}
}
Updates

Lead Judging Commences

inallhonesty Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

`mulWadUp` has a bad overflow check

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.