First Flight #8: Math Master
First Flight #8
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: low
Valid

Incorrect error selector and memory offset in `MathMasters::mulWad` and `MathMasters::mulWadUp`

n0kto

Description

Two errors are present in the code which will prevent to return the right error:

  1. The revert statement uses the wrong memory offset. It should use the same offset as mstore, plus 28 bytes, because the selector is placed at the end of the 32 bytes in memory and has a length of 4. Here, it should be 0x5c.

  2. The selector 0xbac65e5b does not correspond to MathMasters__MulWadFailed. The correct selector for this error is 0xa56044f7.

function mulWad(uint256 x, uint256 y) internal pure returns (uint256 z) {
// @solidity memory-safe-assembly
assembly {
// Equivalent to `require(y == 0 || x <= type(uint256).max / y)`.
if mul(y, gt(x, div(not(0), y))) {
@> mstore(0x40, 0xbac65e5b) // `MathMasters__MulWadFailed()`.
@> revert(0x1c, 0x04)
}
z := div(mul(x, y), WAD)
}
}
function mulWadUp(uint256 x, uint256 y) internal pure returns (uint256 z) {
/// @solidity memory-safe-assembly
assembly {
// Equivalent to `require(y == 0 || x <= type(uint256).max / y)`.
if mul(y, gt(x, or(div(not(0), y), x))) {
@> mstore(0x40, 0xbac65e5b) // `MathMasters__MulWadFailed()`.
@> revert(0x1c, 0x04)
}
...
}
}

Impact

Likelihood: Medium

  • Will occur every the multiplication overflows.

Impact: Low

  • The program will revert with no error, leading to unexpected behavior in any contract using this library.

Proof of Concept

Foundry PoC
function testMulWadWrongError() public {
vm.expectRevert(MathMasters.MathMasters__MulWadFailed.selector);
MathMasters.mulWad(1e68, 1e68);
}

Recommended Mitigation

Replace the values as follows:

function mulWad(uint256 x, uint256 y) internal pure returns (uint256 z) {
// @solidity memory-safe-assembly
assembly {
// Equivalent to `require(y == 0 || x <= type(uint256).max / y)`.
if mul(y, gt(x, div(not(0), y))) {
- mstore(0x40, 0xbac65e5b) // `MathMasters__MulWadFailed()`.
- revert(0x1c, 0x04)
+ mstore(0x40, 0xa56044f7) // `MathMasters__MulWadFailed()`.
+ revert(0x5c, 0x04)
}
z := div(mul(x, y), WAD)
}
}
Updates

Lead Judging Commences

inallhonesty Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

Wrong error selector

Wrong error storage

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.