Moonwell

Summary

The provided Solidity smart contract, MErc20DelegateFixer, exhibits a high-severity vulnerability due to unchecked math operations, particularly in the getCashPrior function. This vulnerability may lead to arithmetic overflow or underflow, posing a significant risk to the integrity of financial calculations within the contract.

Vulnerability Details

The critical vulnerability lie 134 in the following line of code within the getCashPrior function:

The addition operation lacks proper overflow and underflow checks, creating a scenario where unexpected behavior and potential financial loss can occur

Impact

Exploiting this vulnerability could have severe consequences, including the manipulation of cash calculations, loss of funds, or even a denial-of-service attack. The getCashPrior function plays a crucial role in determining the available cash in the market, and an unchecked addition operation significantly jeopardizes the accuracy of this calculation.

Tools Used

The vulnerability was identified through manual code review.

Recommendations

1.Immediate Patching: Prioritize an urgent update to the contract code by implementing proper overflow and underflow checks in the vulnerable line of code.
Example:

2. Use SafeMath Library or Solidity Built-in Checks: Incorporate the OpenZeppelin SafeMath library or leverage the built-in overflow and underflow checks available in Solidity versions >=0.6.0 and <0.8.0 to ensure secure arithmetic operations.

3. Upgrade to the Latest Solidity Version: Consider upgrading the Solidity version to the latest stable release to benefit from improved language features, security enhancements, and bug fixes.