NoOne - Arithmetic Overflow and Underflow Vulnerabilities in `adjust` Function

[sherlock-admin2]

NoOne

medium

Arithmetic Overflow and Underflow Vulnerabilities in adjust Function

Summary

The adjust function in the smart contract is designed to modify the quantity of tokens claimable by a user (beneficiary). However, it lacks safeguards against arithmetic overflows and underflows, posing significant security risks.

Vulnerability Detail

The function performs arithmetic operations (addition and subtraction) without any checks for overflows or underflows. This can result in incorrect token balances or potentially allow for manipulation of the contract’s state.

Impact

• Without proper checks, an overflow in the addition operations can cause the total tokens and beneficiary's tokens to wrap around, leading to incorrect balances.
• An underflow in the subtraction operations can similarly cause unexpected large values, allowing beneficiaries to claim more tokens than intended.

  Code Snippet

  here here

Tool used

Manual Review

Recommendation

Implement the SafeMath library from OpenZeppelin to handle all arithmetic operations. This will automatically manage overflow and underflow conditions, ensuring the safe execution of addition and subtraction.