Audit finding: Unchecked Math Could Impact Weight Calculation
Project: MantaNetwork
Auditor: Halborn
Location: runtime/calamari/src/fee.rs:76
primitives/manta/src/xcm.rs:183,251,252
runtime/manta/src/fee.rs:47,52
runtime/common/src/lib.rs:115
primitives/manta/src/constants.rs:110
Impact: Low
Vulnerability class (Scout): Weight Management

4.4 (HAL-04) UNCHECKED MATH COULD IMPACT WEIGHT CALCULATION - LOW (2.5)\nDescription:\nIt was identified that several areas in the buy_weight and the refund_weight functions that could potentially benefit from enhanced computational checks. Currently, despite numerous instances of proven arithmetic calculations, the function does not have a mechanism to handle situations where underflow or overflow states might occur.\nWhile these states haven’t been identified as potential risks for exploitation, implementing additional safeguards to account for them will be beneficial.\nAnother point of consideration pertains to the WEIGHT_PER_SECOND value. This value serves as a divisor in computing the number of tokens required for payment or refund during the weight purchasing procedure. While it is predetermined as a constant during the system’s compilation, it currently lacks a constraint to assure that it never equals zero. This is a significant potential risk as it could result in a system panic if the value happens to be zero, causing a division by zero error. Moreover, as the WEIGHT_PER_SECOND value is also used in calculations elsewhere in the system, this issue could potentially affect other sections of the codebase as well.\nCode Location:\nUnsafe multiplication in the tests multiplier_growth_simulator_and_congestion_budget_test:\nListing 10: runtime/calamari/src/fee.rs (Line 76)\n69 #[ test ]\n#[ ignore ] // This test should not fail CI\n71 fn multiplier_growth_simulator_and_congestion_budget_test () {\n72 let target_daily_congestion_cost_usd = 100 _000 ;\n73 let kma_price = fetch_kma_price () . unwrap () ;\n74 println! (" KMA / USD price as read from CoinGecko = { kma_price } ") ;\n75 let target_daily_congestion_cost_kma =\n76 ( target_daily_congestion_cost_usd as f32 / kma_price * KMA as f32 ) as u128 ;\nUnsafe multiplication in buy_weight function\nListing 11: primitives/manta/src/xcm.rs (Line 183)\n146 fn buy_weight (& mut self , weight : Weight , payment : Assets ) -> Result < Assets > {\n153 let first_asset = payment . fungible_assets_iter () . next () . ok_or ({\n160 XcmError :: TooExpensive }) ?;\n183 let amount = units_per_second * ( weight as u128 ) / ( WEIGHT_PER_SECOND as u128 ) ;\nUnsafe subtraction in refund_weight function\nListing 12: primitives/manta/src/xcm.rs (Line 251)\n248 fn refund_weight (& mut self , weight : Weight ) -> Option < MultiAsset > {\n251 self . weight -= weight ;\n252 let amount = * units_per_second * ( weight as u128 ) / ( WEIGHT_PER_SECOND as u128 ) ;\nPlaces where WEIGHT_PER_SECOND is used as a divisor:\n• Function refund_weight\nListing 13: primitives/manta/src/xcm.rs (Line 252)\n• Function buy_weight:\nListing 14: primitives/manta/src/xcm.rs (Line 183)\nThe following snippets show how the q divisor is calculated and how it’s equal to zero if WEIGHT_PER_SECOND is zero too.\nListing 15: runtime/manta/src/fee.rs (Lines 47,52)\nRecommendation:\nWe recommend a review of these identified areas to ensure that adequate arithmetic checks are in place and a safety constraint is set for WEIGHT_PER_SECOND to prevent it from reaching zero. These improvements will further fortify the system, ensuring stability, reliability, and secure operation.\n• It is recommended to add a constraint to ensure that WEIGHT_PER_SECOND is never 0.\n• In “release” mode, Rust does not panic! due to overflows and overflowed values simply “wrap” without any explicit feedback to the user. It is recommended to use vetted safe math libraries for arithmetic operations consistently throughout the smart contract system. Consider replacing the multiplication operator with Rust’s checked_mul method, the subtraction operator with Rust’s checked_subs method, and so on.

Summary: Unchecked math in weight calculations may lead to overflow, underflow, or division by zero errors.