043.md

Bnke0x0

low

Math.max(<x>,0) used with int cast to uint

Summary

Vulnerability Detail

Impact

The code casts an int to a uint before passing it to Math.max(). It seems as though the Math.max() call is attempting to prevent values from being negative, but since the int is being cast to uint, the value will never be negative, and instead will overflow if either the multiplication involving the slope and timestamp is positive. I wasn’t able to find a scenario where this is the case, but this seems very dangerous, and the Math.max() call is sending misleading signals, so I suggest moving it to inside the cast to unit

Code Snippet

https://github.com/sherlock-audit/2023-01-optimism/blob/main/optimism/packages/contracts-bedrock/contracts/L1/ResourceMetering.sol#L145 => uint256 gasCost = resourceCost / Math.max(block.basefee, 1000000000); https://github.com/sherlock-audit/2023-01-optimism/blob/main/optimism/packages/contracts-bedrock/contracts/libraries/Arithmetic.sol#L26 => return SignedMath.min(SignedMath.max(_value, _min), _max);

Tool used

Manual Review

Recommendation