Good Entry - auditsea's results

Lines of code

https://github.com/code-423n4/2023-08-goodentry/blob/71c0c0eca8af957202ccdbf5ce2f2a514ffe2e24/contracts/TokenisableRange.sol#L333-L339

Vulnerability details

Impact

In TokenisableRange -> returnExpectedBalanceWithoutFees function, sqrtPriceX96 is calculated using prices of two tokens, but the calculation overflows which will result in the transaction revert.

Proof of Concept

(amt0, amt1) = LiquidityAmounts.getAmountsForLiquidity( uint160( sqrt( (2 ** 192 * ((TOKEN0_PRICE * 10 ** TOKEN1.decimals) / TOKEN1_PRICE)) / ( 10 ** TOKEN0.decimals ) ) ), TickMath.getSqrtRatioAtTick(lowerTick), TickMath.getSqrtRatioAtTick(upperTick),  liquidity);

(2 ** 192 * ((TOKEN0_PRICE * 10 ** TOKEN1.decimals) / TOKEN1_PRICE)) is calculated at once, assuming token1's decimal is 18, 2^192 * 10^18 ~ 2^252, it means when token0 price is more than 16x of token1 price, it will overflow causing revert.

Tools Used

Manual Review

Mitigation Steps

Do not put whole 2^192 in the calculation but just put 10^18 or whatever smaller number and then deal with remaining number outside of sqrt.

Assessed type

Math