Submission Details
Severity:
`Statistics::stddev` can revert due to improper data type in `Statistics::variance`
Summary
Statistics::stddev can revert due to incorrect data type usage in the Statistics::variance function.
Vulnerability Details
The Statistics::variance function is used to calculate variance.
The issue is the way we calculate the diff which is uint (unsigned integer), this can cause underflow in a case where data[i] < mean.
function variance(uint256[] memory data) internal pure returns (uint256 ans, uint256 mean) {
mean = avg(data);
uint256 sum = 0;
for (uint256 i = 0; i < data.length; i++) {
uint256 diff = data[i] - mean; <@ // Leads to underflow when data[i] < mean
sum += diff * diff;
}
ans = sum / data.length;
}
Impact
The Statistics::stddev function will revert, which in turn reverts a crucial call (finalizeValidation).
Tools Used
Manual Review.
Recommendations
It is recommended to use signed integer instead of unsigned.
Updates
Lead Judging Commences
inallhonesty 10 months ago
Submission Judgement Published Assigned finding tags:
Underflow in computing variance
Prize pool breakdown
Total prize
21,000 USDC
nSLOC
1,03420 USDC / LOC
20,000 USDC
1,000 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.