Notional x Index Coop - Ruhum's results

Report

Low

L-01: outdated comment in wfCashLogic.sol regarding the address that receives tokens on burn

In line L230 of the wfCashLogic contract, it states that the from address should receive the tokens. But, it's actually the user-specified opts.receiver address.

L-02: _safeNegInt88() conversion isn't really safe

Here's the function: https://github.com/code-423n4/2022-06-notional-coop/blob/main/notional-wrapped-fcash/contracts/wfCashERC4626.sol#L243

function _safeNegInt88(uint256 x) private pure returns (int88) {
    int256 y = -int256(x);
    require(int256(type(int88).min) <= y);
    return int88(y);
}

When converting an uint to an int you have to first check whether the uint value is larger than the max. int value, since int.max * 2 == uint.max

So the very first line can trigger an overflow.

I think the correct conversion should be:

require(uint256(type(int88).max) >= x); // check whether x is small enough to be an `int88`
return int88(-int256(x)); // if it's small enough we can freely convert to `int256`, turn it into a negative value, and then turn it into an `int88`

But, the function doesn't seem to be used anywhere.