Submitted by 0xTaylor
https://github.com/reserve-protocol/protocol/blob/df7ecadc2bae74244ace5e8b39e94bc992903158/contracts/p1/BackingManager.sol#L228
https://github.com/reserve-protocol/protocol/blob/df7ecadc2bae74244ace5e8b39e94bc992903158/contracts/p1/BasketHandler.sol#L421
Converting uint8 to int8 can have unexpected consequences when done unsafely. This issue affects the quote function in BasketHandler.sol and handoutExcessAssets in BackingManager.sol. While there is some risk here, the issue is unlikely to be exploited as ERC-20 tokens generally dont have a decimals value over 18, nevertheless one over 127.
Chisel
Validate that the decimals value is within an acceptable upper-bound before attempting to cast it to a signed integer.
0xean (judge) commented:
tbrent (Reserve) acknowledged and commented:
