Sablier

Sablier
DeFiFoundry
53,440 USDC
View results
Submission Details
Severity: low
Invalid

The formula used to calculate saturation ` uint256 saturation = ((bitField >> 8) & 0xFF) % 80 + 20;` return range [0,99], this way 100% saturation is never achieved.

Summary

In SablierV2NFTDescriptor::generateAccentColor 100% saturation is never actually achieved.

Vulnerability Details

In contract SablierV2NFTDescriptor the generateAccentColor function calculates saturation by this formula and expect it to be in range [20,100].

uint256 saturation = ((bitField >> 8) & 0xFF) % 80 + 20;

according to docs The saturation is a percentage where 0% is grayscale and 100%, but here the range is bounded to [20,100] to make the colors more lively. but here by using this formula 100% saturation is never achieved. The ((bitField >> 8) & 0xFF) % 80 will always return a value between [0,79] and never reach 80. which thus result in overall range from 20 to 99. This way 100% saturation is never achieved.

Impact

The 100% saturation percentage is never achieved.

Tools Used

Manual Aalysis

Recommendations

use this line of code instead of old one to count the lightness.

- uint256 saturation = ((bitField >> 8) & 0xFF) % 80 + 20;
+ uint256 saturation = ((bitField >> 8) & 0xFF) % 81 + 20;

this way the saturation will come in range [20,100] as the protocol intended it to be.

Updates

Lead Judging Commences

inallhonesty Lead Judge over 1 year ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

Info/Gas/Invalid as per Docs

https://docs.codehawks.com/hawks-auditors/how-to-determine-a-finding-validity

0xnevi Judge
over 1 year ago
inallhonesty Lead Judge
about 1 year ago
inallhonesty Lead Judge about 1 year ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

Info/Gas/Invalid as per Docs

https://docs.codehawks.com/hawks-auditors/how-to-determine-a-finding-validity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.