fee_growth_inside calculations doesnt allow oveflow/underflow

[howlbot-integration]

Lines of code

https://github.com/code-423n4/2024-08-superposition/blob/4528c9d2dbe1550d2660dac903a8246076044905/pkg/seawater/src/tick.rs#L163

Vulnerability details

Impact

The get_fee_growth_inside function uses checked_sub to prevent overflow and underflow in fee growth calculations. However, the original Uniswap V3 contract relies on underflow/overflow as part of its fee growth logic. Since fee growth inside a tick range can be both positive and negative, using checked_sub may cause certain users to be unable to update their positions, leading to transaction reverts.

Proof of Concept

get_fee_growth_inside() implements UniswapV3 math to calculate fee growth.

    /// Gets the fee growth inside a tick range.
    pub fn get_fee_growth_inside(
        &mut self,
        lower_tick: i32,
        upper_tick: i32,
        cur_tick: i32,
        fee_growth_global_0: &U256,
        fee_growth_global_1: &U256,
    ) -> Result<(U256, U256), Error> {
        // the fee growth inside this tick is the total fee
        // growth, minus the fee growth outside this tick
        let lower = self.ticks.get(lower_tick);
        let upper = self.ticks.get(upper_tick);
        let (fee_growth_below_0, fee_growth_below_1) = if cur_tick >= lower_tick {
            (
                lower.fee_growth_outside_0.get(),
                lower.fee_growth_outside_1.get(),
            )
        } else {
            (
                //@audit overflow/underflow should be allowed 
                fee_growth_global_0
                    .checked_sub(lower.fee_growth_outside_0.get())
                    .ok_or(Error::FeeGrowthSubTick)?,
                fee_growth_global_1
                    .checked_sub(lower.fee_growth_outside_1.get())
                    .ok_or(Error::FeeGrowthSubTick)?,
            )
        };
...

In this function, the use of checked_sub prevents underflow, which can cause the function to revert with an Error::FeeGrowthSubTick. This behavior is different from the Uniswap V3 implementation, where underflows are allowed and expected in certain scenarios.

Tools Used

Manual

Recommended Mitigation Steps

Modify the get_fee_growth_inside function to allow underflow/overflow by removing the checked_sub checks. This will ensure compatibility with the original Uniswap V3 logic and prevent unexpected transaction reverts for users.

Assessed type

Under/Overflow

[c4-judge]

alex-ppg marked the issue as satisfactory

[c4-judge]

alex-ppg changed the severity to 3 (High Risk)