# Potential Underflow in `withdrawInterest` Crit/High · Sherlock · Hedged stablecoin · 4th December 2024 Finding H-2 of the Autonomint competition. - Protocol: https://audits.sherlock.xyz/contests/569 - Report: /reports/autonomint - Codebase: https://github.com/0xsimao/2024-11-autonomint/tree/0d324e04d4c0ca306e1ae4d4c65f0cb9d681751b - Source: https://github.com/sherlock-audit/2024-11-autonomint-judging/issues/228 --- ### Summary In the `withdrawInterest` function, if `totalInterest` is less than `amount`, subtracting `amount` from `totalInterest` will cause an underflow and revert the transaction due to Solidity 0.8.x's checked arithmetic, even if `totalInterestFromLiquidation` has sufficient balance to cover the withdrawal. ### Root Cause The function checks the combined balance but only subtracts from `totalInterest`: https://github.com/sherlock-audit/2024-11-autonomint/blob/0d324e04d4c0ca306e1ae4d4c65f0cb9d681751b/Blockchain/Blockchian/contracts/Core_logic/Treasury.sol#L616C1-L625C6 ```solidity require(amount <= (totalInterest + totalInterestFromLiquidation), "Treasury don't have enough interest"); totalInterest -= amount; ``` If `totalInterest < amount`, this subtraction underflows and reverts. ### Internal pre-conditions none ### External pre-conditions none ### Attack Path _No response_ ### Impact DOS, underflow and revert. ### PoC 1. Set `totalInterest` to 50 and `totalInterestFromLiquidation` to 100. 2. Attempt to withdraw an `amount` of 75. 3. The `require` passes because 75 ≤ 150. 4. Subtracting 75 from `totalInterest` (50) causes an underflow and reverts. ### Mitigation Implement logic to deduct the `amount` from `totalInterest` and `totalInterestFromLiquidation` proportionally or sequentially: ```solidity if (amount <= totalInterest) { totalInterest -= amount; } else { uint256 remaining = amount - totalInterest; totalInterest = 0; totalInterestFromLiquidation -= remaining; } ```