AntFleet

Disagreement · bb96d68b-anthropic-1

_computeCurrentFee reverts on underflow when startFee < endFee path is not blocked for equal endFee but lastFee already at endFee — but also computes uint24 underflow if startFee==endFee and durationSeconds==0 not pre-checked in DecayMulticurveInitializerHook._beforeSwap

solo Opus
repo a7cc2ed7·PR #2·reviewed 1 week ago

Opus finding

_computeCurrentFee reverts on underflow when startFee < endFee path is not blocked for equal endFee but lastFee already at endFee — but also computes uint24 underflow if startFee==endFee and durationSeconds==0 not pre-checked in DecayMulticurveInitializerHook._beforeSwap

mediumbugmedium
  • src/initializers/DecayMulticurveInitializerHook.sol:110-145
  • src/initializers/DecayMulticurveInitializerHook.sol:148-152
If `setSchedule` is called with `startFee == endFee` (non-descending allowed), then `lastFee == startFee == endFee` at construction. In `_beforeSwap` the first guard `if (schedule.lastFee == schedule.endFee) return` will short-circuit, so `_computeCurrentFee` is never called — safe. However, if `durationSeconds == 0` and `startFee > endFee`, `setSchedule` reverts via `InvalidDurationSeconds`, so safe. The other potential issue: in `_computeCurrentFee` of `RehypeDopplerHookInitializer`, when `startFee == endFee`, the early-return checks `startFee == endFee || durationSeconds == 0` before calling `_computeCurrentFee`, so safe. No real bug here.

Recommendation

No fix required — leave as is, but add explicit invariant tests.

Other reviewer

The other reviewer flagged nothing in this file/line range.

Why this didn't post

This finding didn't meet AntFleet's unanimous agreement threshold. Both frontier models review every PR independently; only findings they both flag with the same severity and category are posted to the PR. This one fell through.

read the methodology →