code-423n4 / 2021-08-gravitybridge-findings

1 stars 0 forks source link

SafeMath library is not always used in `Gravity` #60

Open code423n4 opened 2 years ago

code423n4 commented 2 years ago

Handle

shw

Vulnerability details

Impact

SafeMath library functions are not always used in the Gravity contract's arithmetic operations, which could cause integer underflow/overflows. Using SafeMath is considered a best practice that could completely prevent underflow/overflows and increase code consistency.

Proof of Concept

Referenced code: Gravity.sol#L202 Gravity.sol#L586

Recommended Mitigation Steps

Consider using the SafeMath library functions in the referenced lines of code.

jkilpatr commented 2 years ago

An overflow in the powers would be a significant bug, while it would require some pretty dramatic issues no the go module side there is value in checking in. I agree with the severity

duplicate of #38

loudoguno commented 2 years ago

reopening as per judges assessment as "primary issue" on findings sheet