search

liquity / bold

Ideas for improvements and enhancements in a Liquity v2.
https://www.liquity.org/liquity-v2
27 stars 6 forks source link

Arithmetic underflow in `StabilityPool::offset()` #427

Open danielattilasimon opened 2 weeks ago

danielattilasimon commented 2 weeks ago

Reproduction:

git fetch
git checkout sp-offset-overflow-or-underflow
pnpm i
cd contracts
pnpm fuzz-repro issues/sp-offset-overflow-or-underflow.json -- -vvv
danielattilasimon commented 2 weeks ago

It appears to be underflowing here: https://github.com/liquity/bold/blob/add7a78534af002eb2d9acb286bb3598e0015128/contracts/src/StabilityPool.sol#L472