The setWeights function only stores the uint16 part of _weights[i] in storage (ps.sherXWeight = uint16(_weights[i])).
However, to calculate weightAdd/weightSub the full value (not truncated to 16 bits) is used.
This can lead to discrepancies as the actually added part is different from the one tracked in the weightAdd variable.
Handle
cmichel
Vulnerability details
The
setWeights
function only stores theuint16
part of_weights[i]
in storage (ps.sherXWeight = uint16(_weights[i])
). However, to calculateweightAdd/weightSub
the full value (not truncated to 16 bits) is used. This can lead to discrepancies as the actually added part is different from the one tracked in theweightAdd
variable.