Unsafe downcasts will silently overflow

Summary

There are some unsafe type casting, multiple instances of downcasting from uint256 to smaller unsigned integer types such as uint16, uint32, uint40, and uint56 are performed without checks for overflow. This can lead to silent overflows and unintended behavior in the smart contract.

Vulnerability Detail

Type casting in Solidity does not inherently check for overflows. When a larger uint256 type is cast to a smaller type like uint16, uint32, uint40, or uint56, and the original value exceeds the maximum representable value of the smaller type, an overflow occurs. The result is a completely different value that can lead to logical errors, incorrect computations, and could potentially be exploited.

Impact

If these overflows are exploited or occur unintentionally, they could lead to critical issues in contract logic, such as accounting errors, incorrect balance calculations, or even enabling denial of service and other malicious attacks. This undermines the contract's integrity and can lead to loss of funds or unexpected contract behavior.

Code Snippet

Tool used

Manual Review

Recommendation

It is strongly recommended to perform explicit checks before casting to ensure that the value being cast does not exceed the range of the target type. This can be achieved by using conditionals or assertive functions to verify the safety of the value before performing the cast. Alternatively, SafeMath libraries or the latest Solidity compiler with built-in overflow checks should be used to prevent such issues.

sherlock-audit / 2023-10-looksrare-judging

0xWSeeC - Unsafe downcasts will silently overflow #115