# A sufficiently large collateral may break the maximum owed M calculation Medium · Three Sigma · Stablecoin framework · 8th January, 2024 Finding 3S-M^0-L11 of the M^0 Minter Gateway security review. - Protocol: https://www.m0.org/ - Report: /reports/m-0 - Codebase: https://github.com/0xsimao/ttg/tree/a8127901fa1f24a2e821cf4d9854a1aa6ac8088c - Source: https://cdn.sanity.io/files/qoqld077/production/1cdafafad874aba76e062ad8c216c98338c096db.pdf --- ### Description In the [MinterGateway](https://github.com/MZero-Labs/protocol/blob/3499f50ff3382729f3e59565b19386ba61ef8e36/src/MinterGateway.sol) contract, the updateCollateral function can set a collateral value to any value, provided the value is no larger than type(uint240).max and the data is signed by enough validators. The maxAllowedActiveOwedMOf function will use the collateral value to assess if a minter is undercollateralized: ```solidity function maxAllowedActiveOwedMOf(address minter_) public view returns (uint256) { // NOTE: Since `mintRatio()` is capped at 10,000% (i.e. 1_000_000) this cannot overflow. unchecked { return _minterStates[minter_].isActive ? (uint256(collateralOf(minter_)) * mintRatio()) / ONE : 0; } } ``` The comment note in maxAllowedActiveOwedMOf is incorrect, because the multiplication of a large mintRatio with a large collateral can overflow a uint256. In the unlikely scenario that validators allow a very odd and large collateral value, this multiplication will silently overflow due to the unchecked block, leading to a wrong calculation of the maximum allowed debt. ### Recommendation Remove the unchecked block in this situation to avoid a silent overflow. For better readability, consider raising a custom error instead of letting the compiler raise a panic error upon overflow. ### Status Addressed in [#06b6cb1](https://github.com/MZero-Labs/protocol/commit/06b6cb1593da5baffa60d50fb75a0767dd754a6b). --- Related findings: - [Error in OstiumPairsStorage::groupMaxCollateral() calculation](https://0xsimao.com/findings/ostium-pairs-storage-group-collateral): Ostium