Unnecessary checked arithmetic in Auction.settleAuction(), Auction.bondBurn(), Basket.changePublisher(), Basket.changeLicenseFee() and Basket.publishNewIndex()

[code423n4]

Handle

pants

Vulnerability details

The functions Auction.settleAuction() and Auction.bondBurn() contain this line:

require(bondBlock + ONE_DAY <= block.number);

Similarly, the function Basket.changePublisher() contains the line

require(block.number >= pendingPublisher.block + TIMELOCK_DURATION);

the function Basket.changeLicenseFee() contains the line

require(block.number >= pendingLicenseFee.block + TIMELOCK_DURATION);

and the function Basket.publishNewIndex() contains the line

require(block.number >= pendingWeights.block + TIMELOCK_DURATION);

Each of bondBlock, pendingPublisher.block, pendingLicenseFee.block and pendingWeights.block is either zero (at initialization) or equal to some block.number, so they won't go any near to type(uint256).max at the upcoming decades. Therefore, there is no risk of overflow caused by these additions.

Impact

Additions perform overflow checks that are not necessary in this case.

Tool Used

Manual code review.

Recommended Mitigation Steps

Surround these lines with unchecked { ... } blocks to avoid the default overflow checks.

[GalloDaSballo]

Blocks don't risk overflow (until end of universe) but they may if you end up using a smaller uint size for packing.

I agree with the finding, but would not be concerned if you didn't apply it