You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
The AuxMath library is a custom auxiliary math library that performs multiplication and division with rounding specifications.
The implementation of mulDivUp and mulDivDown first compute the multiplication of a uint256 with a uint256 without taking into account the possibility of an overflow in the product. The product could overflow into a uint512 in the multiplication step even if the result were to fit into a uint256 after the subsequent division. Hence the current implementation will not give the right result in such a case.
Consider using OpenZeppelin's Math library which implements the mulDiv function that is developed especially considering these scenarios and is widely accepted in the ecosystem.
The text was updated successfully, but these errors were encountered:
ggviana
changed the title
M-04 Math library is vulnerable to shadow overflow
[M-04] Math library is vulnerable to shadow overflow
Oct 16, 2022
Robsonsjre
changed the title
[M-04] Math library is vulnerable to shadow overflow
[OZ: M-04] Math library is vulnerable to shadow overflow
Oct 16, 2022
The
AuxMath
library is a custom auxiliary math library that performs multiplication and division with rounding specifications.The implementation of
mulDivUp
andmulDivDown
first compute the multiplication of auint256
with auint256
without taking into account the possibility of an overflow in the product. The product could overflow into auint512
in the multiplication step even if the result were to fit into auint256
after the subsequent division. Hence the current implementation will not give the right result in such a case.Consider using OpenZeppelin's Math library which implements the
mulDiv
function that is developed especially considering these scenarios and is widely accepted in the ecosystem.The text was updated successfully, but these errors were encountered: