code-423n4 / 2021-10-defiprotocol-findings

0 stars 0 forks source link

Unnecessary checked arithmetic in `Basket.handleFees()` #27

Open code423n4 opened 3 years ago

code423n4 commented 3 years ago

Handle

pants

Vulnerability details

The function Basket.handleFees() contains this line:

uint256 timeDiff = (block.timestamp - lastFee);

bondBlock is either zero (at initialization) or equal to some block.timestamp, so it can never be greater than the current block.timestamp. Therefore, there is no risk of underflow caused by this subtraction.

Impact

Subtractions perform underflow checks that are not necessary in this case.

Tool Used

Manual code review.

Recommended Mitigation Steps

Surround this line with an unchecked { ... } block to avoid the default underflow check.

GalloDaSballo commented 2 years ago

Valid finding