It is possible to revert because overflow in getPhaseSwitchoverData
Summary
In ChainlinkAggregator.sol we have getPhaseSwitchoverData() function.
The function returns the round count and the next phase starting round for the lastSyncedRound phase. But is possible to overflow under certain conditions.
Vulnerability Detail
Let's look at the following code from the function:
27: function phaseId(ChainlinkRound memory self) internal pure returns (uint16) {
28: return uint16(self.roundId >> PHASE_OFFSET);
29: }
So we run into a situation where phaseToSearch can be very close to the maximal number of uint16 and the function can immediately revert because of overflow in the while loop.
89: phaseToSearch++;
Impact
getPhaseSwitchoverData() function revert because overflow
tsvetanovv
medium
It is possible to revert because overflow in
getPhaseSwitchoverData
Summary
In
ChainlinkAggregator.sol
we have getPhaseSwitchoverData() function. The function returns the round count and the next phase starting round for the lastSyncedRound phase. But is possible to overflow under certain conditions.Vulnerability Detail
Let's look at the following code from the function:
This portion of the code determines where the next phase starts if the
lastSyncedRound
is the final round in its phase beforelatestRound
.The problem here is that the
phaseToSearch
variable can be very close to the maximum number ofuint16
becausephaseId
returnuint16
.So we run into a situation where
phaseToSearch
can be very close to the maximal number ofuint16
and the function can immediately revert because of overflow in the while loop.Impact
getPhaseSwitchoverData()
function revert because overflowCode Snippet
https://github.com/sherlock-audit/2023-05-perennial/blob/main/perennial-mono/packages/perennial-oracle/contracts/types/ChainlinkAggregator.sol#L61-L94
Tool used
Manual Review
Recommendation
Change
uint16 phaseToSearch
to a larger number. You can make ituint32
oruint64