amount variables can be uint88

[code423n4]

Handle

sirhashalot

Vulnerability details

Impact

The amount and amountUnlocked variables can be uint88 instead of uint256 because the maximum value of these variables is a uint88 (the MAX_TOTAL_XDEFISUPPLY constant). As further evidence, the amount variable is cast to uint88 in the _lock() function and the position.depositedXDEFI value is uint88.

Proof of Concept

The amount and amountUnlocked_ variables are found throughout

Recommended Mitigation Steps

Use a smaller uint size to reduce storage and gas costs

[deluca-mike]

Unfortunately, at times, types that aren't 256-bits use more gas. Further, function arguments aren't compacted, so there is no benefit to unising types smaller than 256 bits as function arguments.

[Ivshti]

yep, unless it's storage non-words use more gas