sherlock-audit / 2023-11-convergence-judging

8 stars 8 forks source link

jah - wrong calculation which leads to a not being able to function properly #221

Closed sherlock-admin closed 11 months ago

sherlock-admin commented 11 months ago

jah

high

wrong calculation which leads to a not being able to function properly

Summary

wrong maths leads to revert

Vulnerability Detail

in the function _ysCvgCheckpoint if the actualCycle is not divisible by 12 it will run some additional codes and line 592 might revert in some case for example lets say actualCycle is 1 since 1 is not divisble be 12 it will go into the if statement and line 592 will be run which is uint256 nextTdeCycle = (actualCycle / TDE_DURATION + 1) * TDE_DURATION + 1; nextdeCycle will be zero because (1/13) 13 is zero and in the next line ` uint256 ysNextTdeAmount = ((nextTdeCycle - realStartCycle) ysTotalAmount) / TDE_DURATION; ` it will do some calculation in our case nextTdeCycle is zero and it will try to subtract from zero which will cause an error and will revert since the actualCycle starts from 1 if the user have percentage to lock yscvg it will revert

Impact

sc not being able to lock propely

Code Snippet

https://github.com/sherlock-audit/2023-11-convergence/blob/main/sherlock-cvg/contracts/Locking/LockingPositionService.sol#L592

Tool used

Manual Review

Recommendation

correct the maths

nevillehuang commented 11 months ago

Invalid, nextTdeCycle = (1 / 12 + 1) * 12 + 1 = (0 + 1) * 12 + 1 = 13, so no issue here.