256 to 112 could cause a wrong lock amount

[code423n4]

Lines of code

https://github.com/aurafinance/aura-contracts-lite/blob/main/contracts/AuraLocker.sol#L268

Vulnerability details

Impact

256 to 112 could cause a wrong lock amount

Proof of Concept

for the call stack of "function _lock" , _amount is u256, manually cut to u112, could change actual value of _amount.

Tools Used

Recommended Mitigation Steps

still use u256, instead of cutting to u112

[0xMaharishi]

max u112 is 5e33. Tokens have 18 decimals. This is equivalent to 1,000,000,000,000,000e18. Max supply of most tokens is 1e26 or so. Aura token included

[dmvt]

This is technically true but it's unreasonable to think that any user will be locking enough tokens in one go to cause this issue to occur. I will leave it as QA.