Aptos Pizza Drop
Cyfrin
Beginner FriendlyGameFi
100 EXP
View results
Previous Next
Submission Details
Impact: high
Likelihood: medium
Invalid

Integer Overflow in Reward Calculation

raminidalf

Root + Impact

Description

  • The contract is expected to calculate rewards based on user deposits and time elapsed.

  • However, the multiplication in reward calculation can exceed the maximum uint256 value, causing an overflow.

uint256 reward = depositAmount @> * timeElapsed * rewardRate;
​

Risk

Likelihood:

  • Occurs when users stake very large amounts for long periods.

  • Triggered by multiplying multiple large values.

Impact:

  • Rewards calculation becomes incorrect.

  • Attackers may mint excessive tokens or revert execution.

Proof of Concept

// Deposit large values until reward overflows
contract.attack(2**128, 365 days);
​

Recommended Mitigation

Use OpenZeppelin’s SafeMath or Solidity’s built-in checked arithmetic to prevent overflow.
Updates

Appeal created

bube Lead Judge 11 days ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.