Summary

The divUp functions in the Math library lack overflow checks when adding 1 to the division result. If the result of the division is the maximum value representable by the SD59x18 or UD60x18 types, adding 1 would cause an overflow, leading to an incorrect result.

Vulnerability Details

The divUp functions are designed to perform ceiling division, rounding the result up to the nearest integer if there is a remainder. However, they do not account for the possibility of an overflow when adding 1 to the division result:

https://github.com/Cyfrin/2024-07-zaros/blob/main/src/utils/Math.sol#L9-L15

If the division result (a.div(b)) is equal to the maximum value of the respective type (type(SD59x18).max or type(UD60x18).max), adding 1 will cause an overflow, wrapping the result back to the minimum value. This would lead to an incorrect calculation and potential errors in the system relying on this result.

Impact

The overflow in the divUp function could lead to incorrect results in calculations that rely on this function, potentially affecting the accuracy of financial calculations, interest rates, or other critical values.

Tools Used

Manual review

Recommendations

Implement overflow checks before adding 1 to the division result in both divUp functions. If the division result is the maximum value, either revert the transaction with an error or return a specific value to indicate the overflow condition.