Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Difference between calculated and stored uint sizes can lead to overflows #19

Closed
3esmit opened this issue Sep 14, 2023 · 1 comment · Fixed by #35
Closed

Difference between calculated and stored uint sizes can lead to overflows #19

3esmit opened this issue Sep 14, 2023 · 1 comment · Fixed by #35
Assignees
Labels
bug Something isn't working

Comments

@3esmit
Copy link

3esmit commented Sep 14, 2023

All balances in MiniMeToken are saved as uint128 in the checkpoints (as
well as total supplies). Since all inputs and calculations are done with uint256, there were no
checks for the uin128 size thus allowing overflows.
While on most tokens such amounts are unrealistic (config dependant on the decimals), this
might also open up an unintended centralization risk that could’ve been avoided (minter can
deliberately zero out someone’s balance - or even the total supply - just by minting, which
shouldn’t be expected).
Current overflow checks are all on uint256 size, so they don’t circumvent this potential issue.

@3esmit 3esmit self-assigned this Sep 14, 2023
3esmit added a commit that referenced this issue Sep 14, 2023
@3esmit 3esmit added enhancement New feature or request bug Something isn't working and removed enhancement New feature or request labels Sep 22, 2023
@3esmit
Copy link
Author

3esmit commented Sep 23, 2023

PR #22 changed everything to uint128, however this caused an overhead on processing, which is not necessary.

If we guarantee there is no overflows in mint/burn functions, than any other overflow in transfer would be mathematically impossible.

@3esmit 3esmit mentioned this issue Sep 25, 2023
4 tasks
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working
Projects
None yet
Development

Successfully merging a pull request may close this issue.

1 participant