SNARKeling Treasure Hunt
First Flight #59
Beginner FriendlyGameFiFoundry
100 EXP
View all submissions
Previous Next
Submission Details
Impact: low
Likelihood: low

getRemainingTreasures() Underflow Risk

Author Revealed upon completion

Root + Impact

Description

  • The getRemainingTreasures() view function calculates MAX_TREASURES - claimsCount without any protection against potential future logic where claimsCount could exceed MAX_TREASURES. While currently protected by the claim() function's AllTreasuresClaimed check, a view function should not rely on state transition invariants.

// @> TreasureHunt.getRemainingTreasures()
function getRemainingTreasures() external view returns (uint256) {
return MAX_TREASURES - claimsCount; // Could underflow if claimsCount > MAX_TREASURES
}

Risk

Likelihood:

  • Reason 1

Impact:

  • Future code changes could enable underflow

  • View functions should be safe under all conditions

  • Violates defensive programming principles

Proof of Concept

​

Recommended Mitigation

Add an explicit check or use a saturating subtraction:

function getRemainingTreasures() external view returns (uint256) {
+ if (claimsCount >= MAX_TREASURES) return 0;
return MAX_TREASURES - claimsCount;
}

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!