Liquidity Management
Gamma
DeFiFoundry
50,000 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

Overflow error in `getUserDeposits` function

bhorprakash

Description

The function getUserDeposits retrieves user deposit IDs from an EnumerableSet. However, the loop index variable i is declared as uint8, which could lead to potential issues if length exceeds the maximum value that uint8 can hold (255). Since length is derived from EnumerableSet.length, there is a possibility that more than 255 deposits exist, which would result in an overflow or unintended behavior.

function getUserDeposits(address user) external view returns (uint256[] memory depositIds) {
uint256 length = EnumerableSet.length(userDeposits[user]);
depositIds = new uint256[](length);
for (uint8 i = 0; i < length; ) {
depositIds[i] = EnumerableSet.at(userDeposits[user], i);
unchecked {
i = i + 1;
}
}
}
​

Impact

If a user has more than 255 deposits, the function may not return all deposit IDs correctly.

Potential risk of an integer overflow if manipulated incorrectly in future code changes.

Unexpected behavior could impact downstream applications relying on this function for correct deposit retrieval.

Recommendation

Change the loop index variable i from uint8 to uint256 to ensure compatibility with the possible range of values returned by EnumerableSet.length.

Updated Code Suggestion:

​
function getUserDeposits(address user) external view returns (uint256[] memory depositIds) {
uint256 length = EnumerableSet.length(userDeposits[user]);
depositIds = new uint256[](length);
for (uint256 i = 0; i < length; ) {
depositIds[i] = EnumerableSet.at(userDeposits[user], i);
unchecked {
i = i + 1;
}
}
}
Updates

Lead Judging Commences

n0kto Lead Judge 8 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

Informational or Gas

Please read the CodeHawks documentation to know which submissions are valid. If you disagree, provide a coded PoC and explain the real likelihood and the detailed impact on the mainnet without any supposition (if, it could, etc) to prove your point.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.