60,000 USDC
Submission Details
Severity:
The unsafe casting of the recovered amount from `uint256` to `uint8`
Vulnerability Details
The unsafe casting of the recovered amount from uint256 to uint8 which may result in a loss of precision or even an overflow.
//Found in: "src/sn/Cairo.so"
450: for (uint256 i = 0; i < length; ++i) {
451 uint256 asciiValue = (value >> (8 * (length - 1 - i))) & 0xFF;
452 byteString[i] = bytes1(uint8(asciiValue));
453: }
Impact
loss of precision or even an overflow.
Tools Used
Aderyn
Recommendations
asciiValue should be of type uint256. Alternatively, use OpenZeppelin’s SafeCast library when casting from uint256 to uint8.
Prize pool breakdown
Total prize
60,000 USDC
nSLOC
2,30126 USDC / LOC
50,000 USDC
5,500 USDC
4,500 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.