# Function stabilize() might always revert because of overflow since Malt contract use solidity 0.8

MaltDataLab reads Uniswap V2 cumulative prices that wrap on overflow, but Solidity 0.8 subtraction reverts, permanently bricking stabilize().

- Payout: Contest reward
- Severity: medium
- Program: Malt Protocol
- Credited: minhquanym
- Disclosed: 2023-05-01
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2023-02-malt-findings/issues/15
- Library page: https://bugbountylibrary.com/r/c4%3A2023-02-malt%3AM-13
- Tags: domain:web3 impact:dos kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:dos

**Target:** StabilizerNode.stabilize / MaltDataLab.trackPool TWAP math
**Root cause:** Uniswap V2 pair (Solidity 0.5.16) intentionally lets priceCumulativeLast overflow/wrap; MaltDataLab (Solidity 0.8) subtracts the wrapped cumulative from its stored last value, which reverts on underflow.
**Steps:**
1. Observe UniswapV2Pair._update uses unchecked-style addition where overflow is desired for price0CumulativeLast/price1CumulativeLast.
2. Note MaltDataLab.trackPool computes `(priceCumulative - maltPriceCumulativeLast) / (blockTimestampLast - maltPriceTimestampLast)` under Solidity 0.8 checked math.
3. After the pool cumulative wraps, priceCumulative < maltPriceCumulativeLast, so the subtraction underflows and reverts.
4. stabilize() calls trackPool() first, so every stabilize() call reverts, disabling stabilization.
**How found:** Cross-referenced Uniswap V2's documented intentional overflow of cumulative price accumulators against Malt's Solidity 0.8 checked subtraction of those same values.
**Insight:** When integrating Uniswap V2 TWAP accumulators, remember the source contract relies on wrapping arithmetic; any 0.8 consumer must replicate unchecked subtraction or it will brick once the cumulative wraps.