Potential Overflow in Bit Shift Amount Calculation

[c4-bot-3]

Lines of code

https://github.com/code-423n4/2024-07-karak/blob/f5e52fdcb4c20c4318d532a9f08f7876e9afb321/src/entities/BeaconProofsLib.sol#L133

Vulnerability details

Description

The calculation of bitShiftAmount could potentially overflow if validatorIndex is very large, as it's multiplied by 64:

https://github.com/code-423n4/2024-07-karak/blob/f5e52fdcb4c20c4318d532a9f08f7876e9afb321/src/entities/BeaconProofsLib.sol#L133

uint256 bitShiftAmount = (validatorIndex % 4) * 64;

While validatorIndex is defined as a uint40, which might seem to limit its maximum value, it's crucial to consider that Solidity performs integer promotion to uint256 for arithmetic operations. This means that if validatorIndex were to somehow contain a value larger than 2^40 - 1, the multiplication could lead to unexpected results.

Impact

If exploited, this overflow could lead to incorrect balance calculations, potentially allowing for manipulation of validator balances. In a proof-of-stake system, this could have significant consequences for validator rewards, slashing, and overall system integrity.

Recommendation

To mitigate this risk, explicitly cast validatorIndex to uint256 before performing the calculation:

uint256 bitShiftAmount = (uint256(validatorIndex) % 4) * 64;

This explicit cast ensures that even if validatorIndex somehow contains a value larger than intended, the calculation will be performed correctly within the uint256 range.

Assessed type

Under/Overflow