In the payout() function in Payout.sol, we have this block of code:
if (unallocatedSherX > 0) {
...
// Subtract from unallocated, as the tokens are now allocated to this payout call
ps.unallocatedSherX = ps.unallocatedSherX.sub(unallocatedSherX);
// Update the memory variable `totalUnallocatedSherX` to execute on `_doSherX` later
totalUnallocatedSherX = totalUnallocatedSherX.add(unallocatedSherX);
}
These two equations can be calculated with unchecked math:
the first because we already have require(ps.unallocatedSherX >= unallocatedSherX) some lines before;
the second because the sum of all unallocatedSherX for every token should be bounded by the total supply of SherX.
Handle
0xsanson
Vulnerability details
Impact
In the
payout()
function in Payout.sol, we have this block of code:These two equations can be calculated with unchecked math:
require(ps.unallocatedSherX >= unallocatedSherX)
some lines before;unallocatedSherX
for every token should be bounded by the total supply of SherX.Proof of Concept
Payout.sol L142
Tools Used
editor
Recommended Mitigation Steps
Uncheck the math to save a little gas.