Beginner FriendlyFoundry
100 EXP
View results
Submission Details
Severity: low
Valid

Incorrect Memory location of revert data

Description: The MathMasters::mulWad & MathMasters::mulWadUp functions reverts with the last 4 bytes of the first memory slot(0x1c) which could contain garbage data or be empty.

Impact: Medium, Both functions revert wrong errors or no errors at all

POC:

function testFail_mulWadRevertsWrongError() public {
vm.expectRevert(MathMasters.MathMasters__MulWadFailed.selector);
MathMasters.mulWad(UINT256_MAX, UINT256_MAX);
}

Recommendation:

/// @dev Equivalent to `(x * y) / WAD` rounded down.
function mulWad(uint256 x, uint256 y) internal pure returns (uint256 z) {
// @solidity memory-safe-assembly
assembly {
// Equivalent to `require(y == 0 || x <= type(uint256).max / y)`.
if mul(y, gt(x, div(not(0), y))) {
@> mstore(0x0, 0xbac65e5b) // `MathMasters__MulWadFailed()`.
@> revert(0x1c, 0x04)
@> //OR Using free memory pointer
@> // let freepointer := mload(0x40)
@> // mstore(freepointer, 0xbac65e5b) // `MathMasters__MulWadFailed()`.
@> // revert(add(freepointer,0x1c), 0x04)
}
z := div(mul(x, y), WAD)
}
}
Updates

Lead Judging Commences

inallhonesty Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

Wrong error storage

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.