Maverick contest - sces60107's results

Lines of code

https://github.com/code-423n4/2022-12-Stealth-Project/blob/main/maverick-v1/contracts/models/PoolInspector.sol#L40 https://github.com/code-423n4/2022-12-Stealth-Project/blob/main/maverick-v1/contracts/models/PoolInspector.sol#L90 https://github.com/code-423n4/2022-12-Stealth-Project/blob/main/router-v1/contracts/libraries/BytesLib.sol#L12

Vulnerability details

Impact

There is a known medium severity bug which affects memory writing in Solidity version 0.8.13. It would remove unused writes to memory and storage https://github.com/ethereum/solidity-blog/blob/499ab8abc19391be7b7b34f88953a067029a5b45/_posts/2022-06-15-inline-assembly-memory-side-effects-bug.md https://medium.com/certora/overly-optimistic-optimizer-certora-bug-disclosure-2101e3f7994d

Since pragmas are floating in the contracts. the contracts may suffer from the issue. For example, the following contract has the issue. It only uses mstore in the inline assembly block. So it will be removed in Solidity 0.8.13.

https://github.com/code-423n4/2022-12-Stealth-Project/blob/main/maverick-v1/contracts/models/PoolInspector.sol#L90

    function _getBinsAtTick(IPool pool, int32 tick) internal view returns (IPool.BinState[] memory bins) {
        uint8 binCounter = NUMBER_OF_KINDS;
        bins = new IPool.BinState[](binCounter);
        for (uint8 i = 0; i < NUMBER_OF_KINDS; i++) {
            uint128 binId = pool.binPositions(tick, i);
            if (binId != 0) {
                IPool.BinState memory bin = pool.getBin(binId);
                bins[NUMBER_OF_KINDS - binCounter] = bin;
                binCounter--;
            }
        }
        if (binCounter != 0) {
            assembly {
                mstore(bins, sub(mload(bins), binCounter))
            }
        }
    }

Proof of Concept

All the contracts use floating pragmas.

pragma solidity ^0.8.0;

And these contracts have the inline assembly blocks which have memory write that is never read again.

https://github.com/code-423n4/2022-12-Stealth-Project/blob/main/maverick-v1/contracts/models/PoolInspector.sol#L40

    function getActiveBins(IPool pool, uint128 startBinIndex, uint128 endBinIndex) external view returns (BinInfo[] memory bins) {
        uint128 binCounter = pool.getState().binCounter;
        if (endBinIndex != 0) {
            binCounter = binCounter < endBinIndex ? binCounter : endBinIndex;
        }
        bins = new BinInfo[](binCounter);
        uint128 activeCounter = 0;
        for (uint128 i = startBinIndex; i < binCounter; i++) {
            IPool.BinState memory bin = pool.getBin(i + 1);
            if (pool.binPositions(bin.lowerTick, bin.kind) == i + 1 || bin.mergeId != 0) {
                bins[activeCounter] = BinInfo({id: i + 1, kind: bin.kind, lowerTick: bin.lowerTick, reserveA: bin.reserveA, reserveB: bin.reserveB, mergeId: bin.mergeId});
                activeCounter++;
            }
        }
        if (activeCounter != 0) {
            uint128 binCountToRemove = binCounter - activeCounter;
            assembly {
                mstore(bins, sub(mload(bins), binCountToRemove))
            }
        }
    }

https://github.com/code-423n4/2022-12-Stealth-Project/blob/main/maverick-v1/contracts/models/PoolInspector.sol#L90

    function _getBinsAtTick(IPool pool, int32 tick) internal view returns (IPool.BinState[] memory bins) {
        uint8 binCounter = NUMBER_OF_KINDS;
        bins = new IPool.BinState[](binCounter);
        for (uint8 i = 0; i < NUMBER_OF_KINDS; i++) {
            uint128 binId = pool.binPositions(tick, i);
            if (binId != 0) {
                IPool.BinState memory bin = pool.getBin(binId);
                bins[NUMBER_OF_KINDS - binCounter] = bin;
                binCounter--;
            }
        }
        if (binCounter != 0) {
            assembly {
                mstore(bins, sub(mload(bins), binCounter))
            }
        }
    }

https://github.com/code-423n4/2022-12-Stealth-Project/blob/main/router-v1/contracts/libraries/BytesLib.sol#L12

Tools Used

None

Recommended Mitigation Steps

use >= 0.8.14 instead of ^0.8.0