# Expiration calculation overflows if call option duration ≥ 195 days

Cally's uint8 durationDays times 1 days overflows uint24 at 195+ days, making vaults unbuyable and wasting creator gas.

- Payout: Contest reward
- Severity: medium
- Program: Cally
- Credited: hickuphh3
- Disclosed: 2022-07-01
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-05-cally-findings/issues/16
- Library page: https://bugbountylibrary.com/r/c4%3A2022-05-cally%3AM-05
- Tags: domain:web3 impact:dos kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:accounting-error

**Target:** Solidity vault/option contract (createVault expiration math)
**Root cause:** vault.durationDays is uint8; multiplying by 1 days yields a uint24 temporary, which overflows when durationDays*86400 exceeds 2^24-1 (durationDays >= 195).
**Steps:**
1. Create vault with durationDays=195 via `c.createVault(2, address(bayc), premiumIndex, 195, strikeIndex, 0, Cally.TokenType.ERC721)`
2. Call `c.buyOption{value: premium}(vaultId)`
3. Observe revert with arithmeticError due to uint24 overflow in expiration calculation
**How found:** Reasoned about Solidity's implicit type promotion: uint8 * 1 days uses uint24 temporary, computed max safe duration as (2^24-1)/86400 = 194, then wrote a Foundry test to confirm revert at 195 days.
**Exploitation:** Vault creator unintentionally creates a vault whose expiration computation reverts, so no buyer can ever fill the option; creator must initiateWithdraw then withdraw to recover, losing only gas.
**Insight:** When auditing Solidity, check implicit intermediate types from mixed-width arithmetic (uint8 * literal with unit suffix); compute the exact overflow threshold rather than assuming the declared type bounds the result.