From a43e174f84d54434c1996e905d4c1d1450a18960 Mon Sep 17 00:00:00 2001
From: Spablob <99089658+Spablob@users.noreply.github.com>
Date: Thu, 12 Dec 2024 19:22:08 +0000
Subject: [PATCH] fix unsafe casting to uint256 (#357)

---
 contracts/lib/Errors.sol                              | 4 ++++
 contracts/modules/royalty/policies/IpRoyaltyVault.sol | 4 +++-
 2 files changed, 7 insertions(+), 1 deletion(-)

diff --git a/contracts/lib/Errors.sol b/contracts/lib/Errors.sol
index b5d8f8a2..db1a2afe 100644
--- a/contracts/lib/Errors.sol
+++ b/contracts/lib/Errors.sol
@@ -729,6 +729,10 @@ library Errors {
 
     /// @notice Same from and to address.
     error IpRoyaltyVault__SameFromToAddress(address vault, address from);
+
+    /// @notice Negative value for casting to uint256.
+    error IpRoyaltyVault__NegativeValueUnsafeCastingToUint256();
+
     ////////////////////////////////////////////////////////////////////////////
     //                            Vault Controller                            //
     ////////////////////////////////////////////////////////////////////////////
diff --git a/contracts/modules/royalty/policies/IpRoyaltyVault.sol b/contracts/modules/royalty/policies/IpRoyaltyVault.sol
index 72ed18b8..87948fb1 100644
--- a/contracts/modules/royalty/policies/IpRoyaltyVault.sol
+++ b/contracts/modules/royalty/policies/IpRoyaltyVault.sol
@@ -313,7 +313,9 @@ contract IpRoyaltyVault is IIpRoyaltyVault, ERC20Upgradeable, ReentrancyGuardUpg
         uint256 accBalance = $.vaultAccBalances[token];
         uint256 userAmount = balanceOf(claimer);
         int256 rewardDebt = $.claimerRevenueDebt[token][claimer];
-        return uint256(int256((accBalance * userAmount) / totalSupply()) - rewardDebt);
+        int256 pending = int256((accBalance * userAmount) / totalSupply()) - rewardDebt;
+        if (pending < 0) revert Errors.IpRoyaltyVault__NegativeValueUnsafeCastingToUint256();
+        return uint256(pending);
     }
 
     /// @dev Returns the storage struct of IpRoyaltyVault