code-423n4 / 2021-07-sherlock-findings

0 stars 0 forks source link

Sanitize `_weights` in `setWeights` on every use #115

Open code423n4 opened 3 years ago

code423n4 commented 3 years ago

Handle

cmichel

Vulnerability details

The setWeights function only stores the uint16 part of _weights[i] in storage (ps.sherXWeight = uint16(_weights[i])). However, to calculate weightAdd/weightSub the full value (not truncated to 16 bits) is used. This can lead to discrepancies as the actually added part is different from the one tracked in the weightAdd variable.

Evert0x commented 3 years ago

Your recommendation is to do .add(uint16(_weights[i])) for both weightAdd and weightSub?