johba/harb
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Merge pull request 'fix: Overflow guard missing for slots 1-7 in both Optimizer.sol and OptimizerV3Push3.sol (#997)' (#1114) from fix/issue-997 into master

Browse source
This commit is contained in:
johba 2026-03-22 13:56:02 +01:00
commit 29b8f7d426
2 changed files with 7 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

4
onchain/src/Optimizer.sol
View file

@ -361,11 +361,13 @@ contract Optimizer is Initializable, UUPSUpgradeable, IOptimizer {
virtual
returns (uint256 capitalInefficiency, uint256 anchorShare, uint24 anchorWidth, uint256 discoveryDepth)
{
// Guard against non-zero shift and negative mantissa.
// Guard against non-zero shift, negative mantissa, and overflow.
// All 8 slots must be in [0, 1e18] — the uniform dyadic range.
// shift is reserved for future use; uint256() cast silently wraps negatives.
for (uint256 k; k < 8; k++) {
require(inputs[k].shift == 0, "shift not yet supported");
require(inputs[k].mantissa >= 0, "negative mantissa");
require(inputs[k].mantissa <= 1e18, "mantissa overflow");
}
// Extract slots 0 and 1 (shift=0 enforced above — mantissa IS the value)
uint256 percentageStaked = uint256(inputs[0].mantissa);

9
onchain/src/OptimizerV3Push3Lib.sol
View file

@ -17,14 +17,13 @@ library OptimizerV3Push3Lib {
pure
returns (uint256 ci, uint256 anchorShare, uint24 anchorWidth, uint256 discoveryDepth)
{
// Validate mantissa for percentageStaked
require(inputs[0].mantissa <= 1e18, "mantissa overflow");
// Validate that shift is 0 (future-only field, not yet supported)
// and that no mantissa is negative (uint256 cast silently wraps negatives).
// Validate that shift is 0 (future-only field, not yet supported),
// that no mantissa is negative (uint256 cast silently wraps negatives),
// and that all slots are within the [0, 1e18] dyadic range.
for (uint256 k = 0; k < 8; k++) {
require(inputs[k].shift == 0, "shift not yet supported");
require(inputs[k].mantissa >= 0, "negative mantissa");
require(inputs[k].mantissa <= 1e18, "mantissa overflow");
}
uint256 percentagestaked = uint256(uint256(inputs[0].mantissa));