Tadle

Github

• https://github.com/Cyfrin/2024-08-tadle/blob/04fd8634701697184a3f3a5558b41c109866e5f8/src/core/PreMarkets.sol#L888

Summary

There is an underflow issue in _updateReferralBonus function within the PreMarkets contract. This issue arises when calculating the remainingPlatformFee, where the sum of referrerReferralBonus and authorityReferralBonus could exceed the platformFee, leading to an underflow. This results in the remainingPlatformFee wrapping around to a very large number, potentially causing unexpected behavior and significant financial discrepancies in the contract.

Vulnerability Details

The issue is located in the following portion of the _updateReferralBonus function:

If the sum of referrerReferralBonus and authorityReferralBonus exceeds platformFee, the subtraction operation causes an underflow. In Solidity, underflowing an unsigned integer wraps around to the maximum possible value, which can lead to incorrect and highly inflated values for remainingPlatformFee.

Consider the following scenario to illustrate the underflow issue:

• platformFee is set to 1000 units.

• referrerReferralBonus is calculated as 600 units (e.g., 60% of platformFee).

• authorityReferralBonus is calculated as 500 units (e.g., 50% of platformFee).

In this case, the sum of referrerReferralBonus and authorityReferralBonus is 1100 units, which is greater than the platformFee of 1000 units. The subtraction operation would therefore result in:

This calculation results in an underflow, and remainingPlatformFee would incorrectly be set to a large value due to the wrapping behavior of unsigned integers in Solidity.

Impact

The remainingPlatformFee could be erroneously set to a large value, leading to incorrect token balances and potential overpayment to the platform or other involved parties. The referral bonus distribution logic could be compromised, leading to unfair or unintended distribution of funds. Attackers could exploit this underflow by manipulating the referral rates to trigger the underflow, potentially draining the platform's funds or causing other financial damage.

Tools Used

Manual Review

Recommendations

Add a check to ensure that the sum of referrerReferralBonus and authorityReferralBonus does not exceed platformFee before performing the subtraction.