Submission Details
Severity:
Function `sqrt` in `Statistics` lib will revert due to overflow if input is max value of uint256
Summary
TX will revert if function sqrt is called with a max value of uint256 as input. Although it is very unlikely this bug will be triggered in the current implementation of Dria protocol, it should be fixed in order for sqrt to work properly for all inputs.
Vulnerability Details
This is the sqrt function containing the bug:
function sqrt(uint256 x) internal pure returns (uint256 y) {
uint256 z = (x + 1) / 2;
...
Increasing the x by 1 will result in overflow when input is max uint256 value.
Impact
TX reverts when if consuming the sqrt function with max uint256 value as input.
Tools Used
Manual review
Recommendations
Change the implementation of sqrt to avoid overflow:
function sqrt(uint256 x) internal pure returns (uint256 y) {
- uint256 z = (x + 1) / 2;
+ uint256 z = x / 2 + 1;
Prize pool breakdown
Total prize
21,000 USDC
nSLOC
1,03420 USDC / LOC
20,000 USDC
1,000 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.