Submission Details
Severity:
`Statistics::stddev` can revert due to improper data type in `Statistics::variance`
Summary
Statistics::stddev can revert due to incorrect data type usage in the Statistics::variance function.
Vulnerability Details
The Statistics::variance function is used to calculate variance.
The issue is the way we calculate the diff which is uint (unsigned integer), this can cause underflow in a case where data[i] < mean.
function variance(uint256[] memory data) internal pure returns (uint256 ans, uint256 mean) {
mean = avg(data);
uint256 sum = 0;
for (uint256 i = 0; i < data.length; i++) {
uint256 diff = data[i] - mean; <@ // Leads to underflow when data[i] < mean
sum += diff * diff;
}
ans = sum / data.length;
}
Impact
The Statistics::stddev function will revert, which in turn reverts a crucial call (finalizeValidation).
Tools Used
Manual Review.
Recommendations
It is recommended to use signed integer instead of unsigned.
Updates
Lead Judging Commences
inallhonesty 9 months ago
Submission Judgement Published Assigned finding tags:
Underflow in computing variance
Prize pool breakdown
Total prize
21,000 USDC
nSLOC
1,03420 USDC / LOC
20,000 USDC
1,000 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.