Submission Details
Severity:
Potential Overflow/Underflow in Time Calculations
Description:
Location in Code: The
startfunction.The calculation
let bidding_end = time + bidding_duration;does not check for overflows.Extremely large values could cause an overflow in the timestamp.
Impact:
The auction end time may be incorrect, leading to unexpected behavior.
Proof of Code:
fn start(ref self: ContractState, bidding_duration: u64, starting_bid: u64) {
let time = get_block_timestamp();
let bidding_end = time + bidding_duration; // Potential overflow
// ...
}
Recommendation:
Add checks to ensure
bidding_durationis within reasonable limits.Use safe math operations that handle overflows and underflows.
**Corrected Code: **
fn start(ref self: ContractState, bidding_duration: u64, starting_bid: u64) {
let time = get_block_timestamp();
// Check for overflow
assert(bidding_duration <= MAX_BIDDING_DURATION, 'Bidding duration too long');
let bidding_end = time + bidding_duration;
// ...
}
Define
MAX_BIDDING_DURATIONas a reasonable maximum duration.
Rewards breakdown
nSLOC
132This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.