# Incorrect Solidity version in FullMath.sol can cause permanent freezing of assets for arithmetic underflow-induced revert

FullMath.sol ported to Solidity 0.8 gained overflow checks, so getAmountsForLiquidity underflows and reverts, permanently freezing deposits/withdrawals when price exits range.

- Payout: Contest reward
- Severity: high
- Program: Good Entry
- Credited: 3docSec
- Disclosed: 2023-10-02
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2023-08-goodentry-findings/issues/58
- Library page: https://bugbountylibrary.com/r/c4%3A2023-08-goodentry%3AH-06
- Tags: domain:web3 impact:dos impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:regression technique:source-review vuln:accounting-error vuln:dos

**Target:** TokenisableRange.sol / FullMath.sol (Uniswap V3 liquidity math)
**Root cause:** Uniswap V3 FullMath relies on intentional 256-bit overflow (phantom overflow) but was recompiled under Solidity ^0.8.x, adding checked arithmetic that reverts on intermediate overflow/underflow.
**Steps:**
1. Call `LiquidityAmounts.getAmountsForLiquidity(sqrtRatioX96, sqrtRatioAX96, sqrtRatioBX96, 1e18)` with sqrtRatioX96 below sqrtRatioAX96 (e.g. 1834502451234584391374419429242405 vs 1866972058592130739290643700340936) and observe revert.
2. Fork mainnet at block 17811921, deploy TokenisableRange, `initProxy(AaveOracle, USDC, WETH, 1700e10, 1800e10, ...)`, `init(100_000e6, 0)`.
3. Call `tr.returnExpectedBalance(0,0)` and observe revert.
4. Fuzz sqrtRatioX96 modulo (sqrtRatioAX96-1) to confirm revert for all prices below the range.
**How found:** Code review of imported Uniswap V3 libraries noticed FullMath.sol pragma changed to ^0.8.4 despite its documented reliance on phantom overflow; traced callers (returnExpectedBalanceWithoutFees, getTokenAmountsExcludingFees, deposit/withdraw via claimFee) and confirmed with Foundry PoC and fuzz test.
**Exploitation:** No attacker action needed; when the pool price moves above the TokenisableRange's upper tick, claimFee/returnExpectedBalance revert, so deposit and withdraw always revert, locking user funds until price re-enters range (potentially forever).
**Insight:** When auditing forks, diff vendored library pragmas against upstream: libraries designed for unchecked 0.4/0.7 math silently break under 0.8 checked arithmetic, and the revert surfaces only at extreme price ratios, so test boundary tick conditions.