search

code-423n4 / 2022-02-concur-findings

2 stars 0 forks source link

Cast to uint192 is unsafe #271

Closed CloudEllie closed 2 years ago

CloudEllie commented 2 years ago

Judge @GalloDaSballo has assessed the 3rd item in QA Report #197 as Medium risk. The relevant finding follows:

…

Cast to uint192 is unsafe, user trying to deposit more than 2^192 would recevie less deposits balance.

https://github.com/code-423n4/2022-02-concur/blob/72b5216bfeaa7c52983060ebfc56e72e0aa8e3b0/contracts/ConvexStakingWrapper.sol#L235

deposits[_pid][msg.sender].amount += uint192(_amount);
CloudEllie commented 2 years ago

Duplicate of #194