Liquid Staking
Stakelink
DeFiHardhatOracle
50,000 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

uint to int Conversion vulnerability

0bingo76

Summary

The current implementation of balance adjustments in the `VaultDepositController` may not adequately handle both positive and negative changes. Without proper handling, this can lead to incorrect state updates, such as underflows or overflows, resulting in financial discrepancies and vulnerabilities.

https://github.com/Cyfrin/2024-09-stakelink/blob/f5824f9ad67058b24a2c08494e51ddd7efdbb90b/contracts/linkStaking/base/VaultControllerStrategy.sol#L494-L500

Vulnerability Details

Casting from unsigned integers (`uint256`) to signed integers (`int256`) can introduce vulnerabilities. As Solidity supports both signed and unsigned integers at various bit widths (e.g., `int32`, `uint128`), casting from an unsigned to a signed type of the same bit width can result in silent overflow due to bit truncation, as signed types require a sign bit. This means that large unsigned values may exceed the maximum value of the signed type, causing incorrect negative values without explicit errors. To prevent issues, check such casts or avoid them.

Impact

**Silent Overflows**: Casting vulnerabilities can lead to unexpected negative values, potentially allowing attackers to bypass checks or cause the contract to behave unpredictably.
​

Tools Used

manual

Recommendations

Here's a possible fix:

event DepositChangeCalculated(int256 change);
​
/**
* @notice Returns the deposit change since deposits were last updated
* @dev Deposit change could be positive or negative depending on reward rate and whether
* any slashing occurred.
* @return change The signed change in deposits.
*/
function getDepositChange() public view virtual returns (int256 change) {
uint256 totalBalance = token.balanceOf(address(this));
for (uint256 i = 0; i < vaults.length; ++i) {
totalBalance += vaults[i].getTotalDeposits();
}
​
if (totalBalance >= totalDeposits) {
change = int256(totalBalance - totalDeposits);
} else {
change = -int256(totalDeposits - totalBalance);
}
​
emit DepositChangeCalculated(change);
}
Updates

Lead Judging Commences

inallhonesty Lead Judge about 1 year ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.