DeFiHardhat
12,000 USDC
View results
Submission Details
Severity: low
Invalid

No validation of ```reserves[j]``` in ```ConstantProduct2::CalcRate```

Summary

The ConstantProduct2::calcRate calculates the rate between two reserves, identified by indices i and j. There is no check if reserve at index j is zero which is used as division in the calculation.

Vulnerability Details

function calcRate(
uint256[] calldata reserves,
uint256 i,
uint256 j,
bytes calldata
) external pure returns (uint256 rate) {
@> return reserves[i] * CALC_RATE_PRECISION / reserves[j];
}

Impact

If the reserve at index j becomes zero, the calculation of rate would result in a division by zero error. This is because of the denominator in the calculation. When the reserve at index j is zero, dividing by zero is not defined in Solidity, and the contract would revert with an error.

The ConstantProduct2::calcRate function is used in MultiFlowPump::_capRates. The MultiFlowPump::_capRates is responsible for ensuring that the rate of change between two reserves does not exceed specified limits. The rates are calculated to determine if the current reserves are within acceptable bounds compared to the last reserves, based on predefined maximum rate changes. If calcRate encounters a division by zero (i.e., if reserves[j] is zero), it will cause a revert due to the division by zero error. This revert will stop the execution of the _capRates function and any other operations that depend on its completion.
This failure means that the reserves will not be correctly capped, potentially allowing for unchecked rates that could violate the intended constraints of the system.

Tools Used

Manual review

Recommendations

Add a check to ensure that the reserve at index j is not zero before performing the division.

+ if (reserves[j] == 0) {
+ revert("Division by zero in calcRate");
+ }
return reserves[i] * CALC_RATE_PRECISION / reserves[j];
Updates

Lead Judging Commences

giovannidisiena Lead Judge about 1 year ago
Submission Judgement Published
Invalidated
Reason: Design choice
Assigned finding tags:

Informational/Invalid

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.