From 17b1f442199d173579dda90ba3d0b19bcd9cd9e2 Mon Sep 17 00:00:00 2001
From: quaq <56312047+0x0aa0@users.noreply.github.com>
Date: Fri, 26 Jul 2024 09:24:04 -0500
Subject: [PATCH] fix: overflow (#290)

---
 src/EjectionManager.sol             |  2 +-
 test/unit/EjectionManagerUnit.t.sol | 12 ++++++++++++
 2 files changed, 13 insertions(+), 1 deletion(-)

diff --git a/src/EjectionManager.sol b/src/EjectionManager.sol
index 4668c4c8..3a164f57 100644
--- a/src/EjectionManager.sol
+++ b/src/EjectionManager.sol
@@ -150,7 +150,7 @@ contract EjectionManager is IEjectionManager, OwnableUpgradeable{
      */
     function amountEjectableForQuorum(uint8 _quorumNumber) public view returns (uint256) {
         uint256 cutoffTime = block.timestamp - quorumEjectionParams[_quorumNumber].rateLimitWindow;
-        uint256 totalEjectable = quorumEjectionParams[_quorumNumber].ejectableStakePercent * stakeRegistry.getCurrentTotalStake(_quorumNumber) / BIPS_DENOMINATOR;
+        uint256 totalEjectable = uint256(quorumEjectionParams[_quorumNumber].ejectableStakePercent) * uint256(stakeRegistry.getCurrentTotalStake(_quorumNumber)) / uint256(BIPS_DENOMINATOR);
         uint256 totalEjected;
         uint256 i;
         if (stakeEjectedForQuorum[_quorumNumber].length == 0) {
diff --git a/test/unit/EjectionManagerUnit.t.sol b/test/unit/EjectionManagerUnit.t.sol
index 7fcd4905..a70b2689 100644
--- a/test/unit/EjectionManagerUnit.t.sol
+++ b/test/unit/EjectionManagerUnit.t.sol
@@ -377,6 +377,18 @@ contract EjectionManagerUnitTests is MockAVSDeployer {
         ejectionManager.setEjector(address(0), true);
     }
 
+    function test_Overflow_Regression() public {
+        cheats.prank(registryCoordinatorOwner);
+        ejectionManager.setQuorumEjectionParams(0, IEjectionManager.QuorumEjectionParams({
+            rateLimitWindow: 7 days,
+            ejectableStakePercent: 9999
+        }));
+
+        stakeRegistry.recordTotalStakeUpdate(1, 2_000_000_000 * 1 ether);
+
+        ejectionManager.amountEjectableForQuorum(1);
+    }
+
     function _registerOperaters(uint8 numOperators, uint96 stake) internal {
         for (uint i = 0; i < numOperators; i++) {
             BN254.G1Point memory pubKey = BN254.hashToG1(keccak256(abi.encodePacked(i)));