mediumLogic errorEVM-Solidity
Ammplify: Wide cross-zero ranges revert (InvertedRange) due to sign-loss in tick→index and no wrap support
- Payout
- $0
- Protocol
- Ammplify
- Disclosed
- Sep 22, 2025
- Source
- sherlock
Ammplify's tree-based tick routing loses the sign of negative ticks because tickToTreeIndex casts the signed quotient to uint24 before adding the rootWidth/2 offset and never applies a modulo. Combined with RouteImpl.make's strict left<=right requirement and n …
Similar reports
- No close matches yet.
References
This report is already public and closed. Coin Buggie never publishes active or unpatched vulnerability data.