fix: overflow (#290)

Layr-Labs · Jul 26, 2024 · 17b1f44 · 17b1f44
1 parent 3b96caf
commit 17b1f44
Show file tree

Hide file tree

Showing 2 changed files with 13 additions and 1 deletion.
diff --git a/src/EjectionManager.sol b/src/EjectionManager.sol
@@ -150,7 +150,7 @@ contract EjectionManager is IEjectionManager, OwnableUpgradeable{
      */
     function amountEjectableForQuorum(uint8 _quorumNumber) public view returns (uint256) {
         uint256 cutoffTime = block.timestamp - quorumEjectionParams[_quorumNumber].rateLimitWindow;
-        uint256 totalEjectable = quorumEjectionParams[_quorumNumber].ejectableStakePercent * stakeRegistry.getCurrentTotalStake(_quorumNumber) / BIPS_DENOMINATOR;
+        uint256 totalEjectable = uint256(quorumEjectionParams[_quorumNumber].ejectableStakePercent) * uint256(stakeRegistry.getCurrentTotalStake(_quorumNumber)) / uint256(BIPS_DENOMINATOR);
         uint256 totalEjected;
         uint256 i;
         if (stakeEjectedForQuorum[_quorumNumber].length == 0) {

diff --git a/test/unit/EjectionManagerUnit.t.sol b/test/unit/EjectionManagerUnit.t.sol
@@ -377,6 +377,18 @@ contract EjectionManagerUnitTests is MockAVSDeployer {
         ejectionManager.setEjector(address(0), true);
     }
 
+    function test_Overflow_Regression() public {
+        cheats.prank(registryCoordinatorOwner);
+        ejectionManager.setQuorumEjectionParams(0, IEjectionManager.QuorumEjectionParams({
+            rateLimitWindow: 7 days,
+            ejectableStakePercent: 9999
+        }));
+
+        stakeRegistry.recordTotalStakeUpdate(1, 2_000_000_000 * 1 ether);
+
+        ejectionManager.amountEjectableForQuorum(1);
+    }
+
     function _registerOperaters(uint8 numOperators, uint96 stake) internal {
         for (uint i = 0; i < numOperators; i++) {
             BN254.G1Point memory pubKey = BN254.hashToG1(keccak256(abi.encodePacked(i)));