Liquidity Management
Gamma
DeFiFoundry
50,000 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

Integer Underflow in sumReturnUint256 Leading to Denial-of-Service

Deleted user

Summary

The sumReturnUint256 function in MarketUtils library may revert when calculating open interest adjustments due to underflow in negative position size scenarios. While the revert behavior is protected by Solidity 0.8's built-in checks, improved validation and documentation would enhance code clarity.

Vulnerability Details

The function attempts to subtract a negative delta from the current open interest without explicit validation:

function sumReturnUint256(uint256 a, int256 b) internal pure returns (uint256) {
if (b > 0) {
return a + uint256(b);
}
return a - uint256(-b); // Will revert if uint256(-b) > a
}

The function is used in getMinCollateralFactorForOpenInterest() for calculating changes in open interest positions. While Solidity 0.8+ prevents actual underflows through built-in checks, the abrupt reversion could be handled more gracefully.

Impact

  • Severity: Low

  • Likelihood: Low

  • Impact: Low

The issue is mitigated by:

  1. Built-in Solidity 0.8+ overflow/underflow protection

  2. Alignment with business logic (open interest cannot be negative)

  3. No loss of funds possible

Recommendation

Add explicit validation and documentation:

function sumReturnUint256(uint256 a, int256 b) internal pure returns (uint256) {
if (b >= 0) {
return a + uint256(b);
}
uint256 absDelta = uint256(-b);
// Explicit check before subtraction
require(a >= absDelta, "MarketUtils: insufficient open interest for reduction");
return a - absDelta;
}

Tools Used

  • Manual code review

Updates

Lead Judging Commences

n0kto Lead Judge 7 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

Informational or Gas

Please read the CodeHawks documentation to know which submissions are valid. If you disagree, provide a coded PoC and explain the real likelihood and the detailed impact on the mainnet without any supposition (if, it could, etc) to prove your point.

Suppositions

There is no real proof, concrete root cause, specific impact, or enough details in those submissions. Examples include: "It could happen" without specifying when, "If this impossible case happens," "Unexpected behavior," etc. Make a Proof of Concept (PoC) using external functions and realistic parameters. Do not test only the internal function where you think you found something.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.