Beanstalk: The Finale
Beanstalk
DeFiHardhatFoundry
250,000 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

Tansaction will never revert when result is negative in `LibRedundantMathSigned96::sub()` function

0xrolko

Relevant GitHub Links

https://github.com/Cyfrin/2024-05-beanstalk-the-finale/blob/4e0ad0b964f74a1b4880114f4dd5b339bc69cd3e/protocol/contracts/libraries/LibRedundantMathSigned96.sol#L41

Summary

The `LibRedundantMathSigned96::sub()` function is supposed to revert when there is an overflow or an underflow and also when a negative number is returned. But currently when a negative number is returned the function does not revert and returns this number.

Vulnerability Details

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.20;
​
contract sub {
function subtract(int96 a, int96 b) public pure returns (int96) {
return a - b;
}
}

Executing this piece of code on (https://remix.ethereum.org/) with the example values of a=19 and b=209 will not cause an error, even though 19-209=-190 returned a negative value.

Impact

Negative values will be returned where either a revert or a positive value was expected.

Tools Used

remix.ethereum.org

Recommendations

function add(int96 a, int96 b) internal pure returns (int96) {
+ require(a >= b, "Negative value is not allowed")
return a + b;
}
Updates

Lead Judging Commences

inallhonesty Lead Judge about 1 year ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.