Dria

Summary

variance(uint256[] memory) function on Statistics.sol contract will revert due to underflow when mean variable is greater than data point ( data[i] ) and is subtracted from it.

Vulnerability Details

uint256 type variables in Solidity can not store negative numbers. Therefore - everytime you try to calculate a negative diff, where the data point is less than the mean (data[i] < mean) - the function will revert.

Impact

Variance calculation will be reverted and the entire protocol is bricked. This is under the assumptions we mentioned earlier.

Tools Used

Manual review

Recommendations

https://github.com/Cyfrin/2024-10-swan-dria/blob/c8686b199daadcef3161980022e12b66a5304f8e/contracts/libraries/Statistics.sol#L22

Make the diff variable on line 22 int256.