Google Groups no longer supports new Usenet posts or subscriptions. Historical content remains viewable.
Dismiss

10 million lost in market cap because of "in-register" processing.

21 views
Skip to first unread message

Skybuck Flying

unread,
Feb 15, 2024, 2:39:44 AMFeb 15
to
This smart contract bug reminds me of how pmars processes it's instructions:

https://twitter.com/minerercx/status/1757787864299934023

in-register versus in-memory processing HAHA !

10 million lost in market cap.

Here is the code in case the twitter goes down:

function _update(address from, address to, uint256 value, bool mint) internal virtual {
uint256 fromBalance = _balances[from];
uint256 toBalance = _balances[to];
if (fromBalance < value) {
revert ERC20InsufficientBalance(from, fromBalance, value);
}

unchecked {
// Overflow not possible: value <= fromBalance <= totalSupply.
_balances[from] = fromBalance - value;

// Overflow not possible: balance + value is at most totalSupply, which we know fits into a uint256.
_balances[to] = toBalance + value;
}

emit Transfer(from, to, value);

if(mint) {
// Skip burn for certain addresses to save gas
bool wlf = whitelist[from];
if (!wlf) {
uint256 tokens_to_burn = (fromBalance / tokensPerNFT) - ((fromBalance - value) / tokensPerNFT);
if(tokens_to_burn > 0)
_burnBatch(from, tokens_to_burn);
}

// Skip minting for certain addresses to save gas
if (!whitelist[to]) {
if(easyLaunch == 1 && wlf && from == owner()) {
//auto-initialize first (assumed) LP
whitelist[to] = true;
easyLaunch = 2;
} else {
uint256 tokens_to_mint = ((toBalance + value) / tokensPerNFT) - (toBalance / tokensPerNFT);
if(tokens_to_mint > 0)
_mintWithoutCheck(to, tokens_to_mint);
}
}
}
}


The problem is with this code:

internal virtual {
uint256 fromBalance = _balances[from];
uint256 toBalance = _balances[to];
if (fromBalance < value) {
revert ERC20InsufficientBalance(from, fromBalance, value);
}

unchecked {
// Overflow not possible: value <= fromBalance <= totalSupply.
_balances[from] = fromBalance - value;

// Overflow not possible: balance + value is at most totalSupply, which we know fits into a uint256.
_balances[to] = toBalance + value;
}

In case on sends to oneself ! :)

Do you see it ?! ;) =D

Enjoy ! LOL.

Bye,
Skybuck.
0 new messages