Liquidity Management
Gamma
DeFiFoundry
50,000 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

Unsafe Type Conversion Overflow Risk

kimnoic

Summary

A critical integer overflow vulnerability exists in collateral value calculations due to unsafe uint256-to-int256 type casting. This allows large numeric values to wrap to negative numbers, leading to improper liquidation of valid positions and protocol accounting corruption.

Vulnerability Details

Affected Code

// MarketUtils.sol - Line 42-43
int256 remainingCollateralUsd = values.positionCollateralAmount.toInt256()
* collateralTokenPrice.min.toInt256();

Technical Analysis

  1. Conversion Mechanics:

    • positionCollateralAmount (uint256) and collateralTokenPrice.min (uint256) cast to int256 without overflow checks

    • Values exceeding 2^255-1 (≈5.7e76) wrap to negative due to two's complement representation

  2. Exploit Scenario:

// Example values:
uint256 positionCollateralAmount = 1e30; // 1,000,000,000,000,000,000,000,000,000
uint256 price = 1e30; // \$1e30 per token
// Conversion to int256:
int256 convertedCollateral = 1e30.toInt256(); // Wraps to -6930898827444486256...
int256 convertedPrice = 1e30.toInt256(); // Same negative value
// Resulting calculation:
remainingCollateralUsd = negative \* negative = positive (but incorrect magnitude)
​

Impact

  • False Negatives: Valid large positions marked as undercollateralized

  • False Positives: Undercollateralized positions appear solvent

  • All calculations using remainingCollateralUsd become unreliable

Tools Used

Manual review

Updates

Lead Judging Commences

n0kto Lead Judge 8 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

Informational or Gas

Please read the CodeHawks documentation to know which submissions are valid. If you disagree, provide a coded PoC and explain the real likelihood and the detailed impact on the mainnet without any supposition (if, it could, etc) to prove your point.

n0kto Lead Judge 8 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

Informational or Gas

Please read the CodeHawks documentation to know which submissions are valid. If you disagree, provide a coded PoC and explain the real likelihood and the detailed impact on the mainnet without any supposition (if, it could, etc) to prove your point.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.