Unsafe arithmetic casts
The reason for using signed integers in some situations appears to be to use negative values as an indicator to withdraw everything. Using a whole bit of uint256 for this is quite a lot when using `type(uint256).max` would equal or better serve as a flag to withdraw everything.\\nFurthermore, even though the code uses `solidity 0.8.x`, which safeguards arithmetic operations against under/overflows, arithmetic typecast is not protected.\\nAlso, see issue 4.9 for a related issue.\\n```\\n⇒ solidity-shell\\n\\n🚀 Entering interactive Solidity ^0.8.11 shell. '.help' and '.exit' are your friends.\\n » ℹ️ ganache-mgr: starting temp. ganache instance // rest of code\\n » uint(int(-100))\\n115792089237316195423570985008687907853269984665640564039457584007913129639836\\n » int256(uint(2\\*\\*256-100))\\n-100\\n```\\n\\n```\\n// Compute how much collateral needs to be swapt\\nuint256 collateralInPlay = \\_getCollateralInPlay(\\n vAssets.collateralAsset,\\n vAssets.borrowAsset,\\n debtTotal + bonus\\n);\\n\\n// Burn f1155\\n\\_burnMulti(addrs, borrowBals, vAssets, \\_vault, f1155);\\n\\n// Withdraw collateral\\nIVault(\\_vault).withdrawLiq(int256(collateralInPlay));\\n```\\n\\n```\\n// Compute how much collateral needs to be swapt for all liquidated users\\nuint256 collateralInPlay = \\_getCollateralInPlay(\\n vAssets.collateralAsset,\\n vAssets.borrowAsset,\\n \\_amount + \\_flashloanFee + bonus\\n);\\n\\n// Burn f1155\\n\\_burnMulti(\\_addrs, \\_borrowBals, vAssets, \\_vault, f1155);\\n\\n// Withdraw collateral\\nIVault(\\_vault).withdrawLiq(int256(collateralInPlay));\\n```\\n\\n```\\nuint256 amount = \\_amount < 0 ? debtTotal : uint256(\\_amount);\\n```\\n\\n```\\nfunction withdrawLiq(int256 \\_withdrawAmount) external override nonReentrant onlyFliquidator {\\n // Logic used when called by Fliquidator\\n \\_withdraw(uint256(\\_withdrawAmount), address(activeProvider));\\n IERC20Upgradeable(vAssets.collateralAsset).univTransfer(\\n payable(msg.sender),\\n uint256(\\_withdrawAmount)\\n );\\n}\\n```\\n\\npot. unsafe truncation (unlikely)\\n```\\nfunction updateState(uint256 \\_assetID, uint256 newBalance) external override onlyPermit {\\n uint256 total = totalSupply(\\_assetID);\\n if (newBalance > 0 && total > 0 && newBalance > total) {\\n uint256 newIndex = (indexes[\\_assetID] \\* newBalance) / total;\\n indexes[\\_assetID] = uint128(newIndex);\\n }\\n}\\n```\\n
If negative values are only used as a flag to indicate that all funds should be used for an operation, use `type(uint256).max` instead. It is wasting less value-space for a simple flag than using the uint256 high-bit range. Avoid typecast where possible. Use `SafeCast` instead or verify that the casts are safe because the values they operate on cannot under- or overflow. Add inline code comments if that's the case.
```\\n⇒ solidity-shell\\n\\n🚀 Entering interactive Solidity ^0.8.11 shell. '.help' and '.exit' are your friends.\\n » ℹ️ ganache-mgr: starting temp. ganache instance // rest of code\\n » uint(int(-100))\\n115792089237316195423570985008687907853269984665640564039457584007913129639836\\n » int256(uint(2\\*\\*256-100))\\n-100\\n```\\n