Deivitto - Wrong index on `_fundingVote`

[github-actions[bot]]

Deivitto

medium

Wrong index on _fundingVote

Wrong index on _fundingVote

Summary

Type cast with underflow doesn't throw an error / revert

Vulnerability Detail

Even though Solidity 0.8.x is used, type casts do not throw an error. A SafeCast library must be used everywhere a typecast is done. SafeCast Reference.

Impact

Wrong values used for index as underflow doesn't revert on cast affecting correct votation

Proof of Concept

_fundingVote is a internal function used at GrantFund.sol#L141. Inside of it, we find:

uint256 proposalIndex = uint256(_findProposalIndex(proposalId, topTen));

_findProposalIndex can return -1 if not index found, leading to an underflow of a uint256 value, what will be a wrong value for the index.

Code Snippet

https://github.com/sherlock-audit/2023-01-ajna/blob/main/ecosystem-coordination/src/grants/base/StandardFunding.sol#L377

https://github.com/sherlock-audit/2023-01-ajna/blob/main/ecosystem-coordination/src/grants/base/StandardFunding.sol#L520-L534

https://github.com/sherlock-audit/2023-01-ajna/blob/main/ecosystem-coordination/src/grants/GrantFund.sol#L141

Tool used

Manual Review

Recommendation

Use safeCast library for conversions that can overflow / underflow