code-423n4 / 2021-04-marginswap-findings

1 stars 0 forks source link

Different solidity version in UniswapStyleLib.sol #6

Open code423n4 opened 3 years ago

code423n4 commented 3 years ago

Email address

mail@gpersoon.com

Handle

gpersoon

Eth address

gpersoon.eth

Vulnerability details

The solidity version in UniswapStyleLib.sol (>=0.5.0) is different than the solidity version in the other contracts (e.g. ^0.8.0) Also math actions are present in the functions getAmountOut and getAmountIn that could easily lead to an underflow or division by 0; (note safemath is not used). Note: In solidity 0.8.0 safemath like protections are default.

Impact

The impact is low because UniswapStyleLib is a library and the solidity version of the contract that uses the library is used (e.g. ^0.8.0), which has safemath like protections. It is cleaner to have the same solidity version everywhere.

Proof of concept

getAmountIn(3,1,1000) would give division by 0 getAmountIn(1,1,1) will underflow denominator

Recommended mitigation steps

Use the same solidity version everywhere