LenderCommitmentGroup_Smart uses the incorrect getSqrtRatioAtTick function from TickMath.sol
Summary
Vulnerability Detail
The getSqrtRatioAtTick function from TickMath.sol is called inside the getSqrtTwapX96 function to calculate sqrtPriceX96 from the tick.
Starting with version 0.8.0, Solidity introduced checked arithmetic by default, causing operations that would result in an overflow to revert. To prevent revert, getSqrtRatioAtTick() must be enclosed in an unchecked block to allow overflow.
Add an unchecked block to the getSqrtRatioAtTick() function from the TickMath.sol library, which is out of scope but affects the LenderCommitmentGroup_Smart.getSqrtTwapX96 function.
merlin
medium
LenderCommitmentGroup_Smart uses the incorrect getSqrtRatioAtTick function from TickMath.sol
Summary
Vulnerability Detail
The
getSqrtRatioAtTick
function fromTickMath.sol
is called inside thegetSqrtTwapX96
function to calculatesqrtPriceX96
from the tick.Starting with version 0.8.0, Solidity introduced checked arithmetic by default, causing operations that would result in an overflow to revert. To prevent revert,
getSqrtRatioAtTick()
must be enclosed in an unchecked block to allow overflow.contracts/libraries/TickMath.sol#L26C5-L61C6
Impact
getSqrtRatioAtTick()
from theTickMath.sol
library reverts on overflow, which in turn causesgetSqrtTwapX96()
, which is in scope, to revert.Code Snippet
contracts/contracts/LenderCommitmentForwarder/extensions/LenderCommitmentGroup/LenderCommitmentGroup_Smart.sol#L588-L593
Tool used
Manual Review
Recommendation
Add an unchecked block to the
getSqrtRatioAtTick()
function from theTickMath.sol
library, which is out of scope but affects theLenderCommitmentGroup_Smart.getSqrtTwapX96
function.Duplicate of #105