Unsafe type casting

[code423n4]

Handle

WatchPug

Vulnerability details

https://github.com/code-423n4/2021-11-vader/blob/429970427b4dc65e37808d7116b9de27e395ce0c/contracts/tokens/vesting/LinearVesting.sol#L137-L138

vester.amount -= uint192(vestedAmount);

Downcasting from uint256/int256 in Solidity does not revert on overflow. This can easily result in undesired exploitation or bugs.

Recommendation

Consider using SafeCast library from OpenZeppelin.

https://docs.openzeppelin.com/contracts/4.x/api/utils#SafeCast

[SamSteinGG]

type casting is safe as vestedAmount will at all times be lses than vester.amount which in turn fits within the uint192 limit.

[alcueca]

Not necessarily, _getClaim can increase the amount parameter that is passed in, and return a value higher than uint192.

https://github.com/code-423n4/2021-11-vader/blob/429970427b4dc65e37808d7116b9de27e395ce0c/contracts/tokens/vesting/LinearVesting.sol#L294

[SamSteinGG]

@alcueca The value is guaranteed to be less than the amount that is being vested, otherwise the logical constraints of vesting are broken. Can you elaborate how it can exceed the uint limit?