spyrosonic10 - Possible subtraction overflow in mintRollovers

[sherlock-admin]

spyrosonic10

medium

Possible subtraction overflow in mintRollovers

Summary

mintRollovers() keeps accounting of indexes it has processed from rolloverQueue in rolloverAccounting[_epochId]. And later when this function is called logic doesn't check the relationship between index and length and this is important as length of rolloverQueue can decrease due to a call from delistInRollover.

Vulnerability Detail

Due to delist feature length can be shortened and this will lead to index being higher than rolloverQueue.length and can cause underflow error. Due to an underflow error mintRollovers() will not work.

    	uint256 length = rolloverQueue.length;
    	uint256 index = rolloverAccounting[_epochId];

    	// revert if queue is empty or operations are more than queue length
    	if (length == 0) revert OverflowQueue();

    	if (_operations > length || (index + _operations) > length)
        	_operations = length - index;

Impact

mintRollovers() will not work as intended.

Code Snippet

Carousel.sol#L371-L378

Tool used

Manual Review

Recommendation

Consider handling rolloverAccounting and delist properly

Duplicate of #72