prb-math v3.3.2 not audited and contains some errors.

[code423n4]

Lines of code

https://github.com/PaulRBerg/prb-math/blob/1edf08dd73eb1ace0042459ba719b8ea4a55c0e0/package.json#L1-L4

Vulnerability details

Impact

The library prb-math v3.3.2 documents that it is not audited by a security researcher. This means its more risky to rely on this library.

Proof of Concept

{
  "name": "@prb/math",
  "description": "Solidity library for advanced fixed-point math",
  "version": "3.3.2",

prb-math v3.3.2 is being used.

While I set a high bar for code quality and test coverage, you should not assume that this project is completely safe to use. PRBMath has not yet been audited by a third-party security researcher.

prb-math v3.3.2 not audited
Some issues:

• The pow function in UD60x18 reverts when x is lower than 1e18. pow is used in TierCalculationLib.getTierOdds and DrawAccumulatorLib.computeC.
• toSD59x18 ise used in LinearVRGDALib.sol, TieredLiquidityDistributor.sol, DrawAccumulatorLib.sol, TierCalculationLib.sol and PrizePool.sol will be removed in V4.
• Bug in Common.prbExp2: duplicated bitmasks - According to ref :

File: prb-math/src/Common.sol
413:        if (x & 0xFF00000000 > 0) {
440:        if (x & 0xFF00000000 > 0) {

The bit masks used on Line 413 and Line 440 in Common.sol are the same, i.e. 0xFF00000000. The latter should have two fewer zeroes.

• Upgrade to Solidity v0.8.19 and implement operators for UDVTs

Tools Used

Manual Review

Recommended Mitigation Steps

• Current use of prb-math v3.3.2 may break the project's computational protocols
• According to docs prb-math will add a new directory "audits" with PDF references to the audits performed by Cantina.
• Consider redeploying prb-math V4 after being audited.

Assessed type

Math

[c4-judge]

Picodes marked the issue as duplicate of #423

[c4-judge]

Picodes marked the issue as satisfactory