Skip to content
Request an audit

‹ All findings

Potential overflow in PancakeSwapPlugin:getRoutePrice()

MediumClip Finance Strategies·Three Sigma · DeFi infrastructure · 10th November, 20233S-Clip Finance-M01

Description

Currently the price is calculated as uint256 routePrice = FullMath.mulDiv(uint256(sqrtPriceX96) * uint256(sqrtPriceX96), precision0, 2 ** (96 * 2));.

Doing uint256(sqrtPriceX96) * uint256(sqrtPriceX96) might overflow as 2 uint160 variables may result in a number with more than 256 bits. The correct way of calculating this is in OracleLibrary:getQuoteAtTick(), here.

Note: also here.

Status

Addressed in #3d2ad8c