search

code-423n4 / 2023-07-pooltogether-findings

12 stars 7 forks source link

In important libraries of PoolTogether, the pow() function of PRBMath is used, which exhibits inconsistent return values #423

Open code423n4 opened 1 year ago

code423n4 commented 1 year ago

Lines of code

Vulnerability details

The DrawAccumulatorLib.sol and TierCalculationLib.sol libraries inherit a version of PRBMath that contains a critical vulnerability in the pow() function, which can return inconsistent values. This vulnerability is of great importance to the PoolTogether protocol, as the pow() function is used in the computation of TierCalculationLib.getTierOdds and DrawAccumulatorLib.computeC. Recently, another protocol has also experienced the same bug, and the creators of the PRBMath have acknowledged this situation. Here is the corresponding link. Due to time constraints, we were unable to thoroughly address certain rounding errors with mul and div functions of SD59x18. However, these errors have been corrected in PRBMath V4.

Impact

PRBMath pow() function can return inconsistent values

Proof of Concept

Proof of the bug acknowledgment by the creator of the PRBMath

This PR makes four significant changes:

Tools Used

Manual review

Recommended Mitigation Steps

To mitigate this issue, please update the contracts to 0.8.19 and upgrade the PRBMath to version V4.

Assessed type

Math

c4-judge commented 1 year ago

Picodes marked the issue as primary issue

Picodes commented 1 year ago

See also https://github.com/code-423n4/2023-07-pooltogether-findings/issues/6. Regrouping here issues about prb-maths, the main one being the above.

c4-sponsor commented 1 year ago

asselstine marked the issue as sponsor confirmed

c4-judge commented 1 year ago

Picodes changed the severity to 2 (Med Risk)

c4-judge commented 1 year ago

Picodes marked issue #395 as primary and marked this issue as a duplicate of 395

c4-judge commented 1 year ago

Picodes marked the issue as satisfactory

c4-judge commented 1 year ago

Picodes marked the issue as selected for report

asselstine commented 1 year ago

Fixed here: https://github.com/GenerationSoftware/pt-v5-prize-pool/commit/ba56ea8bac3bce06f1e08ae071a19954dd720b1f