Potential Integer Underflow/Overflow: The code uses the SafeCastLib library for type conversions, but it does not handle potential underflow or overflow situations.
Audit: 2023-05-maia-findings
Severity: HIGH

# Lines of code

https://github.com/code-423n4/2023-05-maia/blob/main/src/erc-20/ERC20Boost.sol#L116-L135
https://github.com/code-423n4/2023-05-maia/blob/54a45beb1428d85999da3f721f923cbf36ee3d35/src/erc-20/ERC20Boost.sol#L175-L187
https://github.com/code-423n4/2023-05-maia/blob/54a45beb1428d85999da3f721f923cbf36ee3d35/src/erc-20/ERC20Boost.sol#L198-L227


# Vulnerability details


## Impact

The potential integer underflow/overflow vulnerability in the code can lead to incorrect calculations, unexpected behavior, and potential security issues.


## Proof of Concept

In the provided code, there are a few areas where potential integer underflow/overflow vulnerabilities could be present:


In the **attach** function: [LINK](https://github.com/code-423n4/2023-05-maia/blob/main/src/erc-20/ERC20Boost.sol#L116-L135)


    uint128 userGaugeBoost = balanceOf[user].toUint128();
    
    if (getUserBoost[user] < userGaugeBoost) {
        getUserBoost[user] = userGaugeBoost;
        emit UpdateUserBoost(user, userGaugeBoost);
    }
    
    getUserGaugeBoost[user][msg.sender] = GaugeState({userGaugeBoost: userGaugeBoost, totalGaugeBoost: totalSupply.toUint128()});


If the **balanceOf[user]** or **totalSupply** values can be manipulated to exceed the range of **uint128**, an overflow could occur during the conversion. Similarly, if the **getUserBoost[user]** value is already at the maximum value of **uint128**, an overflow could happen when trying to assign a higher value.

2- In the **decrementGaugeBoost** function: [LINK](https://github.com/code-423n4/2023-05-maia/blob/54a45beb1428d85999da3f721f923cbf36ee3d35/src/erc-20/ERC20Boost.sol#L175-L187)

    gaugeState.userGaugeBoost -= boost.toUint128();


If **boost** is a large value and **gaugeState.userGaugeBoost** is close to zero, subtracting **boost** could lead to an underflow, resulting in an unexpected value.

3- In the **decrementGaugesBoostIndexed** function: [LINK](https://github.com/code-423n4/2023-05-maia/blob/54a45beb1428d85999da3f721f923cbf36ee3d35/src/erc-20/ERC20Boost.sol#L198-L227)


    gaugeState.userGaugeBoost -= boost.toUint128();


Similar to the previous case, an underflow could occur if **boost** is a large value and **gaugeState.userGaugeBoost** is close to zero.

## Tools Used
Manual Review

## Recommended Mitigation Steps

To mitigate these potential integer underflow/overflow vulnerabilities, it is crucial to ensure that the values used in mathematical operations are properly validated and constrained within the appropriate ranges. Additionally, consider using SafeMath or similar libraries to perform arithmetic operations that provide protection against overflows and underflows.

1- Import the SafeMath library:

    import {SafeMath} from "@openzeppelin/contracts/utils/math/SafeMath.sol";

2- Update the relevant code sections to use SafeMath functions:

In the **attach** function:

    uint128 userGaugeBoost = SafeMath.toUint128(balanceOf[user]);
    
    if (getUserBoost[user] < us