Elegant Vanilla Crane - `Rewarder` and `Rewarder2` libraries can overflow

[sherlock-admin2]

Elegant Vanilla Crane

Low/Info

Rewarder and Rewarder2 libraries can overflow

Summary

Rewarder and Rewarder2 libraries can overflow with large integers.

Vulnerability Detail

The Rewarder and Rewarder2 libraries are meant to be used to calculate rewards, however, they do not seem to cover cases where large integers are used.

Impact

Improper calculations for tokens with high decimal counts.

Proof of concept

A test suite can be created for these libraries::

PoC

```solidity // SPDX-License-Identifier: MIT pragma solidity ^0.8.20; import "forge-std/Test.sol"; import "../../src/libraries/Rewarder.sol"; contract RewarderTest is Test { Rewarder.Parameter rewarded; function test_RewarderRounding() public { uint256 MAX_VALUE = 5e29; uint256 accDebtPerShare = Rewarder.getDebtPerShare(1, MAX_VALUE); assertGt(accDebtPerShare, 1e6, "test_RewarderRounding::3"); assertLt(accDebtPerShare, type(uint232).max, "test_RewarderRounding::6"); vm.expectRevert(abi.encodeWithSignature("Panic(uint256)", 0x11)); Rewarder.getDebt(accDebtPerShare, MAX_VALUE); } } ```

Code Snippet

https://github.com/sherlock-audit/2024-06-magicsea/blob/42e799446595c542eff9519353d3becc50cdba63/magicsea-staking/src/libraries/Rewarder.sol#L28

https://github.com/sherlock-audit/2024-06-magicsea/blob/42e799446595c542eff9519353d3becc50cdba63/magicsea-staking/src/libraries/Rewarder2.sol#L28

Tool used

Manual Review

Recommendation

Utilize libraries that handle integers higher than 256 bits.

[0xSmartContract]

In the real world, tokens often have much lower values. Even the most widely used tokens have maximum supplies in the billions or trillions, but do not reach astronomical values ​​like 5e29. However, operations of this magnitude can be performed in some theoretical or special cases. Therefore, it is low. Also This issue was submitted as low/info.