Moonwell - Topmark's results

Lines of code

https://github.com/code-423n4/2023-07-moonwell/blob/main/src/core/MultiRewardDistributor/MultiRewardDistributor.sol#L848 https://github.com/code-423n4/2023-07-moonwell/blob/main/src/core/MultiRewardDistributor/MultiRewardDistributor.sol#L892

Vulnerability details

Impact

Avoidable Multiplication Overflow Error could prevent execution of compulsory code executions causing denial of Service when necessary code needs to be executed but due preventable over flow error it cant be executed

Proof of Concept

https://github.com/code-423n4/2023-07-moonwell/blob/main/src/core/MultiRewardDistributor/MultiRewardDistributor.sol#L848 https://github.com/code-423n4/2023-07-moonwell/blob/main/src/core/MultiRewardDistributor/MultiRewardDistributor.sol#L892

 848.     uint256 supplierDelta = mul_(_supplierTokens, deltaIndex);
...
 892.     uint256 supplierDelta = mul_(_BorrowerTokens, deltaIndex);

Tools Used

Solidity,Hardhat

Recommended Mitigation Steps

division in fragment should prevent this

 function mul_(Double memory a, Double memory b) pure internal returns (Double memory) {
   -     return Double({mantissa: mul_(a.mantissa, b.mantissa) / doubleScale});
   +    return Double({mantissa: mul_(a.mantissa, b.mantissa/expScale) / expScale});
    }

Assessed type

DoS