search

code-423n4 / 2021-05-fairside-findings

0 stars 0 forks source link

Incorrect type conversion in the contract `ABC` makes users unable to burn FSD tokens #78

Closed code423n4 closed 3 years ago

code423n4 commented 3 years ago

Handle

shw

Vulnerability details

Editing on a previous post to correct some details

Impact

The function _calculateDeltaOfFSD of contract ABC incorrectly converts an int256 type parameter, _reserveDelta, to uint256 by explicit conversion, which in general results in an extremely large number when the provided parameter is negative. The extremely large number could cause a DSMath operation sub at line 43 to underflow and revert, and thus the FSD tokens cannot be burned. (_reserveDelta is negative when burning FSD tokens)

Proof of Concept

Simply calling fsd.burn after a successful fsd.mint will trigger this bug.

Referenced code: ABC.sol#L43 ABC.sol#L49 ABC.sol#L54

Recommended Mitigation Steps

Should get the _reserveDelta absolute value by an abs function, for example:

function abs(int x) private pure returns (int) {
    return x >= 0 ? x : -x;
}
fairside-core commented 3 years ago

Extension of #77