The removedLiquidity variable has a potential risk of underflow vulnerability #495
Labels
2 (Med Risk)
Assets not at direct risk, but function/availability of the protocol could be impacted or leak value
bug
Something isn't working
downgraded by judge
Judge downgraded the risk level of this issue
duplicate-516
partial-25
Incomplete articulation of vulnerability; eligible for partial credit only (25%)
Lines of code
https://github.com/code-423n4/2023-11-panoptic/blob/aa86461c9d6e60ef75ed5a1fe36a748b952c8666/contracts/SemiFungiblePositionManager.sol#L979
Vulnerability details
Impact
In the
_createLegInAMM
function, theremovedLiquidity
variable may overflow. Once this happens, it can cause significant errors, resulting in a very large value for theremovedLiquidity
variable.The variable
removedLiquidity
is referenced in the function_getPremiaDeltas
to calculate the premium. A serious error in the variable 'removedLiquidity' will cause a significant error in the calculation of the user's premium.Proof of Concept
The following is a partial code excerpt from the
_createLegInAMM
function:Note the statement:
removedLiquidity -= chunkLiquidity;
is contained in theunchecked{}
code block, which means solidity will not check for integer overflow. IfchunkLiquidity
is greater thanremovedLiquidity
, thenremovedLiquidity
will become a very large number due to integer underflow.Tools Used
Manual audit
Recommended Mitigation Steps
Add a conditional judgment before the statement
removedLiquidity -= chunkLiquidity;
Assessed type
Under/Overflow
The text was updated successfully, but these errors were encountered: