search

code-423n4 / 2023-04-caviar-findings

9 stars 4 forks source link

Upgraded Q -> 3 from #891 [1683219170863] #1002

Closed c4-judge closed 1 year ago

c4-judge commented 1 year ago

Judge has assessed an item in Issue #891 as 3 risk. The relevant finding follows:

[L-1]: Unsafe casting may overflow Context:

virtualBaseTokenReserves += uint128(netInputAmount - feeAmount - protocolFeeAmount); L230 virtualNftReserves -= uint128(weightSum); L231 virtualBaseTokenReserves -= uint128(netOutputAmount + protocolFeeAmount + feeAmount); L323 virtualNftReserves += uint128(weightSum); L324 Description:

While Solidity 0.8.x checks for overflows on arithmetic operations, it does not do so for casting.

Recommendation:

Use OpenZeppelin’s SafeCast library to prevent unexpected overflows.

c4-judge commented 1 year ago

GalloDaSballo marked the issue as duplicate of #167

c4-judge commented 1 year ago

GalloDaSballo marked the issue as satisfactory