Underflow Vulnerability in `emitForWeek` function

[hats-bug-reporter[bot]]

Github username: @Jelev123 Twitter username: zhulien_zhelev Submission hash (on-chain): 0x0307777832518f381c273ad66e01a633b050ecda48af77f360df70d287e47aef Severity: medium

Description: Description\ The emitForWeek function in the contract is responsible for calculating and emitting TAP tokens for the current week. It also handles the unclaimed emissions from the previous week by adding them to the current week's emission. However, there is an underflow vulnerability in the calculation of unclaimed emissions. Specifically, the calculation:

unclaimed = emissionForWeek[week - 1] - mintedInWeek[week - 1];

can result in an underflow if mintedInWeek[week - 1] is greater than emissionForWeek[week - 1]. This underflow can lead to incorrect emissions being recorded, potentially resulting in unintended token distribution and financial losses.

Attack Scenario\ An attacker can exploit this vulnerability by manipulating the mintedInWeek values to ensure that they are greater than the corresponding emissionForWeek values. When the emitForWeek function is called, the underflow will occur, leading to an incorrect calculation of unclaimed. This incorrect value can then be used to increase the emissions for the current week, allowing the attacker to mint more TAP tokens than intended, effectively inflating the token supply and causing significant financial damage.

Attachments

1. Proof of Concept (PoC) File

https://github.com/hats-finance/Tapioca-0xe0b920d38a0900af3bab7ff0ca0af554129f54ad/blob/ed5d47ef05ddc61c10cd71e7104b44a99c665d55/contracts/tokens/TapToken.sol#L406

Recommendation

 // Calculate unclaimed emissions from the previous week
    if (emissionForWeek[week - 1] >= mintedInWeek[week - 1]) {
        unclaimed = emissionForWeek[week - 1].sub(mintedInWeek[week - 1]);
    }

[0xRektora]

There are some few invariants to account for that invalidate this finding. Except if you can provide a PoC that breaks this invariant.

emissionForWeek[t] is always greater than mintedInWeek[t]. mintedInWeek[t] is what was minted during week t, and because this is bound to 0-emissionForWeek[t], this value could never be greater than its upper bound.

[Jelev123]

I believe there might still be a potential edge case or misuse scenario where mintedInWeek[t] could unintentionally exceed emissionForWeek[t], leading to an underflow. But i have a problem with my project and i can`t test it right now