search

code-423n4 / 2022-06-nibbl-findings

1 stars 0 forks source link

QA Report #252

Open code423n4 opened 2 years ago

code423n4 commented 2 years ago

Minus before addition

https://github.com/code-423n4/2022-06-nibbl/blob/8c3dbd6adf350f35c58b31723d42117765644110/contracts/NibblVault.sol#L401

_buyoutBid = msg.value + (primaryReserveBalance - fictitiousPrimaryReserveBalance) + secondaryReserveBalance;

This line perform minus before addition which risk underflow. Should add before minus in all case. Change code to this

_buyoutBid = msg.value + primaryReserveBalance + secondaryReserveBalance - fictitiousPrimaryReserveBalance;

This add before minus, so never underflow.

Use "" for data instead of "0"

"0" is not 0x "" is 0x

Sending empty data should send "" not "0"

https://github.com/code-423n4/2022-06-nibbl/blob/8c3dbd6adf350f35c58b31723d42117765644110/contracts/NibblVault.sol#L538

https://github.com/code-423n4/2022-06-nibbl/blob/8c3dbd6adf350f35c58b31723d42117765644110/contracts/NibblVault.sol#L549

IERC1155(_asset).safeTransferFrom(address(this), _to, _assetID, balance, "0");

should be

IERC1155(_asset).safeTransferFrom(address(this), _to, _assetID, balance, "");
HardlyDifficult commented 2 years ago

Merging with https://github.com/code-423n4/2022-06-nibbl-findings/issues/128

HardlyDifficult commented 2 years ago

Merging with https://github.com/code-423n4/2022-06-nibbl-findings/issues/129

HardlyDifficult commented 2 years ago

Good low risk improvements suggested.