Summary

Revert with a wrong offset resulting in empty return data instead of the selector hash of the custom error

Vulnerability Details

mulWad() and mulWadUp() first store the error selector hash to 0x40 memory, then revert with an offset of 0x1c which is not where the error selector hash is stored

It should first read the free memory pointer for free memory then store the hash to the free memory. For example storing the hash to 0x80 and revert with an offset of 0x9c and a size of 0x04

Impact

Revert with empty return data instead of selector hash of the custom error

Tools Used

Manual review

Recommendations

Store the error selector hash to a proper memory location and revert with a correct offset, for example storing the hash to 0x80 and revert with an offset of 0x9c and a size of 0x04