Submission Details
Severity:
`SeasonGettersFacet` will return incorrect values for cd.mT and cd.mL
Vulnerability Details
SeasonGettersFacet has several functions that rely on the decodedCaseData to return the Relative Temperature Change(mT) and Relative Grown Stalk to Liquidity change(mL). Functions:
function getChangeFromCaseId(uint256 caseId) public view returns (uint32, int8, uint80, int80) {
LibCases.CaseData memory cd = LibCases.decodeCaseData(caseId);
return (cd.mT, cd.bT, cd.mL, cd.bL); // @audit incorrect value for mT and mL
}
function getRelTemperatureChangeFromCaseId(uint256 caseId) external view returns (uint32 mt) {
(mt, , , ) = getChangeFromCaseId(caseId); // @audit incorrect value for mT
return mt;
}
function getAbsBeanToMaxLpRatioChangeFromCaseId(
uint256 caseId
) external view returns (uint80 ml) {
(, , ml, ) = getChangeFromCaseId(caseId); // @audit incorrect value for mL
return ml;
}
The problem is that those values will be always incorrect due to the code for those being commented on LibCases.decodeCaseData
function decodeCaseData(uint256 caseId) internal view returns (CaseData memory cd) {
bytes32 _caseData = getDataFromCase(caseId);
@> // cd.mT = uint32(bytes4(_caseData)); Uncomment if you want to use mT
cd.bT = int8(uint8(bytes1(_caseData << 32)));
@> // cd.mL = uint80(bytes10(_caseData << 40)); Uncomment if you want to use mL
cd.bL = int80(uint80(bytes10(_caseData << 120)));
}
Impact
Values for Relative Temperature Change and Relative Grown Stalk to Liquidity will be always incorrect.
Tools Used
Manual Review
Recommendations
Uncomment the code for mL and mT.
function decodeCaseData(uint256 caseId) internal view returns (CaseData memory cd) {
bytes32 _caseData = getDataFromCase(caseId);
- // cd.mT = uint32(bytes4(_caseData)); Uncomment if you want to use mT
+ cd.mT = uint32(bytes4(_caseData));
cd.bT = int8(uint8(bytes1(_caseData << 32)));
- // cd.mL = uint80(bytes10(_caseData << 40)); Uncomment if you want to use mL
+ cd.mL = uint80(bytes10(_caseData << 40));
cd.bL = int80(uint80(bytes10(_caseData << 120)));
}
Updates
Lead Judging Commences
inallhonesty 12 months ago
Submission Judgement Published Reason: Other
Assigned finding tags:
Informational/Gas
Invalid as per docs https://docs.codehawks.com/hawks-auditors/how-to-determine-a-finding-validity
`SeasonGettersFacet` will return incorrect values for cd.mT and cd.mL
Prize pool breakdown
Total prize
250,000 USDC
nSLOC
12,28520 USDC / LOC
220,000 USDC
10,000 USDC
20,000 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.