search

code-423n4 / 2023-08-pooltogether-mitigation-findings

0 stars 0 forks source link

M-26 MitigationConfirmed #23

Open code423n4 opened 1 year ago

code423n4 commented 1 year ago

Lines of code

Vulnerability details

Comments

In the Vault the ERC20 _transfer ,_mint and _burn methods are overridden to use the TwabController functionality, and these call to the TwabController unsafely cast shares from uint256 to uint96. As a result, if a user tries to transfer/mint/burn more than uint96 shares they will lose some shares during the action due to silent overflows.

Mitigation

The updated implementation uses the OZ SafeCast library to safely cast the input uint256 shares value to uint96 for calls to the relevant TwabController methods. There is now no risk of a silent overflow so the issue is resolved.

Conclusion

LGTM

c4-judge commented 1 year ago

Picodes marked the issue as satisfactory