DexLyn Disclosed Report

https://github.com/hackenproof-public/tokenomics_contract

TITLE:

Arithmetic Overflow in reward_per_token_internal() - u64 * 10^8

SEVERITY: CRITICAL (40% bounty tier)

IN-SCOPE IMPACT: Smart contract unable to operate

FILE: dexlyn_tokenomics/bribe.move

FUNCTION: reward_per_token_internal()

VULNERABILITY:

fun reward_per_token_internal( pool: address ) acquires BribeData { let data = borrow_global<BribeData>(pool);

//  u64 * u64 overflow
let numerator = (reward_per_token as u64) * (10_u64.pow(8));
//              ↑ Could be 1,000,000,000  
//                      * 100,000,000
//                      = 100,000,000,000,000,000 (overflow!)

// u64 max = 18,446,744,073,709,551,615
// Calculation: 1_000_000_000 * 100_000_000 = 10^17
//  10^17 > u64::MAX → ABORT

let result = numerator / (total_supply as u64);
result

}

OVERFLOW MATH:

u64::MAX = 18,446,744,073,709,551,615 ≈ 1.8 * 10^19

If reward_per_token = 1,000,000 (1M tokens) Then: 1,000,000 * 10^8 = 10^14 10^14 < u64::MAX → Works

If reward_per_token = 1,000,000,000 (1B tokens from hyperinflation) Then: 1,000,000,000 * 10^8 = 10^17 10^17 > u64::MAX → OVERFLOW/ABORT!

With BPS bug causing 100x inflation, reward_per_token easily exceeds 1 billion.

IMPACT: Reward calculations abort. Protocol stops working.

FIX: Use u256:

let numerator = (reward_per_token as u256) * (10_u256.pow(8)); let result = numerator / (total_supply as u256);

PROOF OF CONCEPT:

#[test_only]

pub fun test_reward_overflow() { // From hyperinflation: reward_per_token = 1 billion let reward_per_token = 1_000_000_000_u64; let scale = 10_u64.pow(8); // 100,000,000

//  This calculation overflows
let result = reward_per_token * scale;  // 10^17 > u64::MAX
// Transaction ABORTS

// No rewards can be calculated
// Function becomes unusable

}