search

code-423n4 / 2021-06-pooltogether-findings

0 stars 0 forks source link

SafeMath not completely used in yield source contracts #114

Open code423n4 opened 3 years ago

code423n4 commented 3 years ago

Handle

shw

Vulnerability details

Impact

SafeMath is not completely used at the following lines of yield source contracts, which could potentially cause arithmetic underflow and overflow:

  1. line 78 in SushiYieldSource
  2. line 67 in BadgerYieldSource
  3. line 91 and 98 in IdleYieldSource

Proof of Concept

Referenced code: SushiYieldSource.sol#L78 BadgerYieldSource.sol#L67 IdleYieldSource.sol#L91 IdleYieldSource.sol#L98

Recommended Mitigation Steps

Use the SafeMath library functions in the above lines.

asselstine commented 3 years ago

While the arithmetic ceiling is quite high, if an overflow occurred this would significantly disrupt the yield sources. I'd qualify this issue higher as 2 (Med Risk).

dmvt commented 3 years ago

I agree with the sponsor's risk evaluation. Increasing to medium.