compound-finance/comet

Issue in `updateAssetIn` and `isInAsset`

Closed this issue · 0 comments

There is a problem in updateAssetIn with the mask size that is used to update the userBasic[account].assetsIn.

The update is as following:
userBasic[account].assetsIn |= (uint8(1) << assetInfo.offset);

As we can see uint(8) is used to create the matching mask by shifting it by assetInfo.offset to the left.
The problem is that there are more than 8 assets in the system so an 8 bits mask is not enough.

For example, let's assume an asset with assetInfo.offset = 10.
uint8(1) << 10 = 0 so the required mask won't be used and a 0 mask will be used instead.
As a result userBasic[account].assetsIn won't get updated correcly.

The same problem happens in isInAsset when we use an 8 bits mask to get inforamtion from userBasic[account].assetsIn:
return (assetsIn & (uint8(1) << assetOffset) != 0);