Beanstalk: Dive Into Basin

Summary

In the storeLastReserves() function, the length of the lastReserves array is directly cast to a uint8 without checking if the length exceeds the maximum value that a uint8 can hold (255).

Vulnerability Details

storeLastReserves ()

Here is the relevant code:

If the length of lastReserves is greater than 255, casting to uint8 will cause an overflow, resulting in an incorrect value for n.

Impact

This could lead to unexpected behavior when storing and reading the reserves since solidity downcasting does not revert on overflow.

Tools Used

Manua Review

Recommendations

A check should be added to ensure lastReserves.length is within the valid range for a uint8.