Sablier

Sablier
DeFiFoundry
53,440 USDC
View results
Submission Details
Severity: low
Invalid

Because of the formula used to calculate lightness ` uint256 lightness = (bitField & 0xFF) % 70 + 30; `, The 100% lightness percentage is never achieved.

Summary

In SablierV2NFTDescriptor::generateAccentColor 100% lightness is never actually achieved.

Vulnerability Details

In contract SablierV2NFTDescriptor the generateAccentColor function calculates lightness by this formula

uint256 lightness = (bitField & 0xFF) % 70 + 30;

according to docs The lightness is typically a percentage between 0% (black) and 100% (white), but here the range is bounded to [30,100] to avoid dark colors. but here by using this formula 100% lightness is never achieved. The (bitField & 0xFF) % 70 will always return a value between [0,69] and never reach 70. which thus result in overall range from 30 to 99. This way 100% lightness is never achieved.

Impact

The 100% lightness percentage is never achieved.

Tools Used

Manual Analysis

Recommendations

use this line of code instead of old one to count the lightness.

- uint256 lightness = (bitField & 0xFF) % 70 + 30;
+ uint256 lightness = (bitField & 0xFF) % 71 + 30;

this way the lightness will come in range [30,100] as the protocol intended it to be.

Updates

Lead Judging Commences

inallhonesty Lead Judge over 1 year ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

Info/Gas/Invalid as per Docs

https://docs.codehawks.com/hawks-auditors/how-to-determine-a-finding-validity

0xnevi Judge
over 1 year ago
inallhonesty Lead Judge
about 1 year ago
inallhonesty Lead Judge about 1 year ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

Info/Gas/Invalid as per Docs

https://docs.codehawks.com/hawks-auditors/how-to-determine-a-finding-validity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.