Incorrect Return Value in mul_mod Function

[howlbot-integration]

Lines of code

https://github.com/code-423n4/2024-10-superposition/blob/7ad51104a8514d46e5c3d756264564426f2927fe/pkg/seawater/src/maths/full_math.rs#L28

Vulnerability details

The mul_mod function is intended to calculate the result of
a×bmodc, but due to a logical issue, it returns the modified modulus (denoted as c) instead of the result of the modulo operation. This leads to incorrect outcomes when using this function, which can result in unintended behavior, especially in critical financial or cryptographic operations where correct modular arithmetic is essential.

The issue with the return value in the mul_mod function arises because the function is intended to compute
a×bmodc — i.e., it should return the result of multiplying a and b, and then taking the remainder when that product is divided by modulus (denoted as c).
However, the current implementation mistakenly returns the modified modulus itself, rather than the remainder
Why is this a problem?
In modular arithmetic, you typically want to compute a result like this:
result=(a×b)%c This means you:

Multiply a and b together to get a large number (the "product").
Divide the product by c (modulus), and return the remainder from that division as the result.

Instead, the function currently:
Multiplies a and b correctly, storing the product in a temporary variable.
Modifies the modulus variable by performing division (which likely updates its internal representation).
Returns the modified modulus, which is not the result of
a×bmodc.

Example of Correct Logic:
Consider a = 10, b = 20, and c = 7.

200÷7=28 with a remainder of 4.
The function should return 4 because
200%7=4.

Instead, the current function is returning c (or modulus), which is 7, not the remainder 4.

The function needs to return the remainder of the division, not the modified modulus.

Assessed type

Other

[af-afk]

Thankfully this isn't in use. We're going to rip this function out.

[af-afk]

Is it fair to say this is a high issue if we're not using this code?

[alex-ppg]

The Warden has identified a severe flaw in the full_math::mul_mod function as it presently yields the modulo operand instead of the result of the calculation.

As the function remains unused in the codebase, it has a zero likelihood of manifesting in the compiled code of the project and thus merits a QA severity rating.

[c4-judge]

alex-ppg changed the severity to QA (Quality Assurance)

[c4-judge]

alex-ppg marked the issue as grade-b

[af-afk]

Fix: fluidity-money/long.so@8e3ca70#diff-e267677a1062bf9554c301e4f849de0a052be470584d75cc3bf4e3e8a2f3563eL14