Submission Details
Severity:
Unchecked Integer Overflow in offerId Increment
Vulnerability Details
In the PreMarkets contract, the offerId is incremented without checking for potential overflow:
offerId = offerId + 1;
If offerId reaches its maximum value (2^256 - 1 for uint256), it will wrap around to zero on the next increment.
Impact
An overflow of offerId could lead to reuse of existing IDs, potentially causing conflicts in offer management, corrupting data structures, and compromising the integrity of the entire system.
Proof of Concept
function demonstrateOverflow() public {
uint256 maxUint = type(uint256).max;
offerId = maxUint;
// This will cause offerId to overflow
offerId = offerId + 1;
assert(offerId != 0);
// This assertion will fail, demonstrating the overflow
}
Tools Used
Recommendations
Use OpenZeppelin's SafeMath library
Consider implementing a maximum limit for
offerIdand handle the case when this limit is reached.
Prize pool breakdown
Total prize
30,000 USDC
nSLOC
1,22924 USDC / LOC
25,000 USDC
2,750 USDC
2,250 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.