Caviar Private Pools - ayden's results

Judge has assessed an item in Issue #344 as 3 risk. The relevant finding follows:

https://github.com/code-423n4/2023-04-caviar/blob/main/src/PrivatePool.sol#L230#L231 https://github.com/code-423n4/2023-04-caviar/blob/main/src/PrivatePool.sol#L323#L324 To ensure that there is no overflow when converting uint256 to uint128,and the totalNetInputAmount can be extracted so that it does not need to be calculated again later

• virtualBaseTokenReserves += uint128(netInputAmount - feeAmount - protocolFeeAmount);
• virtualNftReserves -= uint128(weightSum);

• uint256 totalNetInputAmount = netInputAmount - feeAmount - protocolFeeAmount;
• require(uint128(totalNetInputAmount) == totalNetInputAmount, "totalNetInputAmount is not an int");
• require(uint128(weightSum) == weightSum, "weightSum is not an int");

Lines of code

https://github.com/code-423n4/2023-04-caviar/blob/main/src/PrivatePool.sol#L736

Vulnerability details

Impact

Let's say when the ERC20 token is USDC with a decimal value of 6, dividing by 1e18 would result in a value that is too small

Proof of Concept

function changeFeeQuote(uint256 inputAmount) public view returns (uint256 feeAmount, uint256 protocolFeeAmount) {
    // multiply the changeFee to get the fee per NFT (4 decimals of accuracy)
    uint256 exponent = baseToken == address(0) ? 18 - 4 : ERC20(baseToken).decimals() - 4;
    uint256 feePerNft = changeFee * 10 ** exponent;

    feeAmount = inputAmount * feePerNft / 1e18;
    protocolFeeAmount = feeAmount * Factory(factory).protocolFeeRate() / 10_000;
}

Tools Used

Manual

Recommended Mitigation Steps

    function changeFeeQuote(uint256 inputAmount) public view returns (uint256 feeAmount, uint256 protocolFeeAmount) {
        // multiply the changeFee to get the fee per NFT (4 decimals of accuracy)
        uint256 exponent = baseToken == address(0) ? 18 - 4 : ERC20(baseToken).decimals() - 4;
        uint256 feePerNft = changeFee * 10 ** exponent;

        feeAmount = inputAmount * feePerNft / 10 ** (exponent+4);
        protocolFeeAmount = feeAmount * Factory(factory).protocolFeeRate() / 10_000;
    }