Beatland Festival

Description:

Description: The Math.mulDiv function in lib/openzeppelin-contracts/contracts/utils/math/Math.sol at line 257 incorrectly uses the bitwise XOR operator (^) instead of the exponentiation operator (**). This means that inverse = (3 * denominator) ^ 2 will perform a bitwise XOR operation with 2 instead of squaring the term (3 * denominator). This is a critical mathematical error that could lead to incorrect calculations for any function relying on mulDiv, potentially causing severe issues like incorrect token balances, price calculations, or other fundamental arithmetic operations within the smart contract.

Location: lib/openzeppelin-contracts/contracts/utils/math/Math.sol#L204-L275

SLITHER OUTPUT:

```

## incorrect-exp

Impact: High

Confidence: Medium

- [ ] ID-0

[Math.mulDiv(uint256,uint256,uint256)](lib/openzeppelin-contracts/contracts/utils/math/Math.sol#L204-L275) has bitwise-xor operator ^ instead of the exponentiation operator **:

- [inverse = (3 * denominator) ^ 2](lib/openzeppelin-contracts/contracts/utils/math/Math.sol#L257)

lib/openzeppelin-contracts/contracts/utils/math/Math.sol#L204-L275

```

Risk

Impact:

This is a critical mathematical error that could lead to incorrect calculations for any function relying on mulDiv, potentially causing severe issues like incorrect token balances, price calculations, or other fundamental arithmetic operations within the smart contract.

Proof of Concept

Recommended Mitigation

Recommendation: Replace the bitwise XOR operator (^) with the exponentiation operator (**) to correctly perform the squaring operation. Ensure thorough testing of the mulDiv function after this change.