totalSupply will revert

[code423n4]

Lines of code

https://github.com/code-423n4/2022-05-vetoken/blob/2d7cd1f6780a9bcc8387dea8fecfbd758462c152/contracts/VE3DLocker.sol#L375-L387

Vulnerability details

Impact

The line for (uint256 i = epochindex - 1; i + 1 != 0; i--) { relies on uint256 underflow and overflow, which would revert in solidity ^0.8.0

Proof of Concept

https://github.com/code-423n4/2022-05-vetoken/blob/2d7cd1f6780a9bcc8387dea8fecfbd758462c152/contracts/VE3DLocker.sol#L375-L387

    function totalSupply() external view returns (uint256 supply) {
        uint256 currentEpoch = block.timestamp.div(rewardsDuration).mul(rewardsDuration);
        uint256 cutoffEpoch = currentEpoch.sub(lockDuration);
        uint256 epochindex = epochs.length;

        //do not include next epoch's supply
        if (uint256(epochs[epochindex - 1].date) > currentEpoch) {
            epochindex--;
        }

        //traverse inversely to make more current queries more gas efficient
        for (uint256 i = epochindex - 1; i + 1 != 0; i--) {

[solvetony]

Duplicate of #150

[GalloDaSballo]

Dup of #150