Submitted by WatchPug, also found by Dravee, gzeon, and TerrierLover
https://github.com/code-423n4/2022-05-vetoken/blob/2d7cd1f6780a9bcc8387dea8fecfbd758462c152/contracts/VE3DLocker.sol#L305-L329
https://github.com/code-423n4/2022-05-vetoken/blob/2d7cd1f6780a9bcc8387dea8fecfbd758462c152/contracts/VE3DLocker.sol#L349-L373
https://github.com/code-423n4/2022-05-vetoken/blob/2d7cd1f6780a9bcc8387dea8fecfbd758462c152/contracts/VE3DLocker.sol#L376-L396
https://github.com/code-423n4/2022-05-vetoken/blob/2d7cd1f6780a9bcc8387dea8fecfbd758462c152/contracts/VE3DLocker.sol#L399-L415
In VE3DLocker.sol, there are multiple instances in which an inversely traverse for loop is used to make more current queries more gas efficient.
For example:
The implementation of the inversely traverse for loop is inherited from Convexs original version: https://github.com/convex-eth/platform/blob/main/contracts/contracts/CvxLockerV2.sol#L333-L334
However, Convexs locker contract is using Solidity 0.6.12, in which the arithmetic operations will overflow/underflow without revert.
As the solidity version used in the current implementation of VE3DLocker.sol is 0.8.7, and there are some breaking changes in Solidity v0.8.0, including:
Ref: https://docs.soliditylang.org/en/v0.8.7/080-breaking-changes.html#silent-changes-of-the-semantics
Which makes the current implementation of inversely traverse for loops always reverts.
More specifically:
As a result, all these functions will be malfunctioning and all the internal and external usage of these function will always revert.
Change VE3DLocker.sol#L315 to:
Change VE3DLocker.sol#L360 to:
Change VE3DLocker.sol#L387 to:
Change VE3DLocker.sol#L406 to:
solvetony (veToken Finance) confirmed and commented:
Alex the Entreprenerd (judge) commented:
