From 5674d76b67d7f0b1fe856a0d21396b6e4b2f85a3 Mon Sep 17 00:00:00 2001
From: Shuhui Luo <107524008+shuhuiluo@users.noreply.github.com>
Date: Sat, 18 May 2024 01:57:04 -0400
Subject: [PATCH] Do `absTick` bounds check in assembly in `getSqrtPriceAtTick`

Updated the MAX_TICK constant value from `-MIN_TICK` to `887272` in TickMath.sol. Enhanced safety check within `getSqrtPriceAtTick` function, replacing previous condition with an assembly block to add memory-safe verification. The new check reverts with `InvalidTick()` if the absolute value of `tick` exceeds `MAX_TICK`.
---
 ...idity to already existing position with salt.snap |  2 +-
 .forge-snapshots/addLiquidity CA fee.snap            |  2 +-
 .forge-snapshots/addLiquidity with empty hook.snap   |  2 +-
 .forge-snapshots/addLiquidity with native token.snap |  2 +-
 ...create new liquidity to a position with salt.snap |  2 +-
 .forge-snapshots/poolManager bytecode size.snap      |  2 +-
 .forge-snapshots/removeLiquidity CA fee.snap         |  2 +-
 .../removeLiquidity with empty hook.snap             |  2 +-
 .../removeLiquidity with native token.snap           |  2 +-
 ...mple addLiquidity second addition same range.snap |  2 +-
 .forge-snapshots/simple addLiquidity.snap            |  2 +-
 ...imple removeLiquidity some liquidity remains.snap |  2 +-
 .forge-snapshots/simple removeLiquidity.snap         |  2 +-
 .forge-snapshots/simple swap with native.snap        |  2 +-
 .forge-snapshots/simple swap.snap                    |  2 +-
 .forge-snapshots/swap CA fee on unspecified.snap     |  2 +-
 .../swap against liquidity with native token.snap    |  2 +-
 .forge-snapshots/swap against liquidity.snap         |  2 +-
 .forge-snapshots/swap burn 6909 for input.snap       |  2 +-
 .../swap burn native 6909 for input.snap             |  2 +-
 .../swap mint native output as 6909.snap             |  2 +-
 .forge-snapshots/swap mint output as 6909.snap       |  2 +-
 .../swap skips hook call if hook is caller.snap      |  2 +-
 .forge-snapshots/swap with dynamic fee.snap          |  2 +-
 .forge-snapshots/swap with hooks.snap                |  2 +-
 .../swap with lp fee and protocol fee.snap           |  2 +-
 .forge-snapshots/swap with return dynamic fee.snap   |  2 +-
 ...ngToMaxLiquidityPerTick_gasCost60TickSpacing.snap |  2 +-
 ...gToMaxLiquidityPerTick_gasCostMaxTickSpacing.snap |  2 +-
 ...gToMaxLiquidityPerTick_gasCostMinTickSpacing.snap |  2 +-
 .../update dynamic fee in before swap.snap           |  2 +-
 src/libraries/TickMath.sol                           | 12 ++++++++++--
 32 files changed, 41 insertions(+), 33 deletions(-)

diff --git a/.forge-snapshots/add liquidity to already existing position with salt.snap b/.forge-snapshots/add liquidity to already existing position with salt.snap
index ff76e7f86..d04ec9776 100644
--- a/.forge-snapshots/add liquidity to already existing position with salt.snap	
+++ b/.forge-snapshots/add liquidity to already existing position with salt.snap	
@@ -1 +1 @@
-153643
\ No newline at end of file
+153562
\ No newline at end of file
diff --git a/.forge-snapshots/addLiquidity CA fee.snap b/.forge-snapshots/addLiquidity CA fee.snap
index b4678d19b..3e48f3a59 100644
--- a/.forge-snapshots/addLiquidity CA fee.snap	
+++ b/.forge-snapshots/addLiquidity CA fee.snap	
@@ -1 +1 @@
-331309
\ No newline at end of file
+331228
\ No newline at end of file
diff --git a/.forge-snapshots/addLiquidity with empty hook.snap b/.forge-snapshots/addLiquidity with empty hook.snap
index c59df0298..0dff0f9a6 100644
--- a/.forge-snapshots/addLiquidity with empty hook.snap	
+++ b/.forge-snapshots/addLiquidity with empty hook.snap	
@@ -1 +1 @@
-286302
\ No newline at end of file
+286221
\ No newline at end of file
diff --git a/.forge-snapshots/addLiquidity with native token.snap b/.forge-snapshots/addLiquidity with native token.snap
index c5bed833e..f93677aae 100644
--- a/.forge-snapshots/addLiquidity with native token.snap	
+++ b/.forge-snapshots/addLiquidity with native token.snap	
@@ -1 +1 @@
-143853
\ No newline at end of file
+143772
\ No newline at end of file
diff --git a/.forge-snapshots/create new liquidity to a position with salt.snap b/.forge-snapshots/create new liquidity to a position with salt.snap
index cbb3de708..246dc363c 100644
--- a/.forge-snapshots/create new liquidity to a position with salt.snap	
+++ b/.forge-snapshots/create new liquidity to a position with salt.snap	
@@ -1 +1 @@
-301821
\ No newline at end of file
+301740
\ No newline at end of file
diff --git a/.forge-snapshots/poolManager bytecode size.snap b/.forge-snapshots/poolManager bytecode size.snap
index 98e877977..8d5759cc5 100644
--- a/.forge-snapshots/poolManager bytecode size.snap	
+++ b/.forge-snapshots/poolManager bytecode size.snap	
@@ -1 +1 @@
-21670
\ No newline at end of file
+21597
\ No newline at end of file
diff --git a/.forge-snapshots/removeLiquidity CA fee.snap b/.forge-snapshots/removeLiquidity CA fee.snap
index 082d59d10..a5c4c193e 100644
--- a/.forge-snapshots/removeLiquidity CA fee.snap	
+++ b/.forge-snapshots/removeLiquidity CA fee.snap	
@@ -1 +1 @@
-186775
\ No newline at end of file
+186689
\ No newline at end of file
diff --git a/.forge-snapshots/removeLiquidity with empty hook.snap b/.forge-snapshots/removeLiquidity with empty hook.snap
index e7fddfb22..9803c7976 100644
--- a/.forge-snapshots/removeLiquidity with empty hook.snap	
+++ b/.forge-snapshots/removeLiquidity with empty hook.snap	
@@ -1 +1 @@
-123143
\ No newline at end of file
+123057
\ No newline at end of file
diff --git a/.forge-snapshots/removeLiquidity with native token.snap b/.forge-snapshots/removeLiquidity with native token.snap
index 8b983838d..bf2eb0242 100644
--- a/.forge-snapshots/removeLiquidity with native token.snap	
+++ b/.forge-snapshots/removeLiquidity with native token.snap	
@@ -1 +1 @@
-119930
\ No newline at end of file
+119844
\ No newline at end of file
diff --git a/.forge-snapshots/simple addLiquidity second addition same range.snap b/.forge-snapshots/simple addLiquidity second addition same range.snap
index ccf9f3450..61c834cb5 100644
--- a/.forge-snapshots/simple addLiquidity second addition same range.snap	
+++ b/.forge-snapshots/simple addLiquidity second addition same range.snap	
@@ -1 +1 @@
-104932
\ No newline at end of file
+104851
\ No newline at end of file
diff --git a/.forge-snapshots/simple addLiquidity.snap b/.forge-snapshots/simple addLiquidity.snap
index 8f3accdaa..34756d9d1 100644
--- a/.forge-snapshots/simple addLiquidity.snap	
+++ b/.forge-snapshots/simple addLiquidity.snap	
@@ -1 +1 @@
-167424
\ No newline at end of file
+167343
\ No newline at end of file
diff --git a/.forge-snapshots/simple removeLiquidity some liquidity remains.snap b/.forge-snapshots/simple removeLiquidity some liquidity remains.snap
index fc72404ca..76a800ad9 100644
--- a/.forge-snapshots/simple removeLiquidity some liquidity remains.snap	
+++ b/.forge-snapshots/simple removeLiquidity some liquidity remains.snap	
@@ -1 +1 @@
-98529
\ No newline at end of file
+98443
\ No newline at end of file
diff --git a/.forge-snapshots/simple removeLiquidity.snap b/.forge-snapshots/simple removeLiquidity.snap
index 0eb1ac8de..de690af58 100644
--- a/.forge-snapshots/simple removeLiquidity.snap	
+++ b/.forge-snapshots/simple removeLiquidity.snap	
@@ -1 +1 @@
-90569
\ No newline at end of file
+90483
\ No newline at end of file
diff --git a/.forge-snapshots/simple swap with native.snap b/.forge-snapshots/simple swap with native.snap
index f7274df9c..5d8e4490c 100644
--- a/.forge-snapshots/simple swap with native.snap	
+++ b/.forge-snapshots/simple swap with native.snap	
@@ -1 +1 @@
-116766
\ No newline at end of file
+116604
\ No newline at end of file
diff --git a/.forge-snapshots/simple swap.snap b/.forge-snapshots/simple swap.snap
index 0ad62553f..6b01bd3d4 100644
--- a/.forge-snapshots/simple swap.snap	
+++ b/.forge-snapshots/simple swap.snap	
@@ -1 +1 @@
-131927
\ No newline at end of file
+131765
\ No newline at end of file
diff --git a/.forge-snapshots/swap CA fee on unspecified.snap b/.forge-snapshots/swap CA fee on unspecified.snap
index 4a45b4425..95761f01f 100644
--- a/.forge-snapshots/swap CA fee on unspecified.snap	
+++ b/.forge-snapshots/swap CA fee on unspecified.snap	
@@ -1 +1 @@
-183065
\ No newline at end of file
+182903
\ No newline at end of file
diff --git a/.forge-snapshots/swap against liquidity with native token.snap b/.forge-snapshots/swap against liquidity with native token.snap
index 1bb863f95..9abac8264 100644
--- a/.forge-snapshots/swap against liquidity with native token.snap	
+++ b/.forge-snapshots/swap against liquidity with native token.snap	
@@ -1 +1 @@
-112487
\ No newline at end of file
+112406
\ No newline at end of file
diff --git a/.forge-snapshots/swap against liquidity.snap b/.forge-snapshots/swap against liquidity.snap
index ede07c134..b4695379d 100644
--- a/.forge-snapshots/swap against liquidity.snap	
+++ b/.forge-snapshots/swap against liquidity.snap	
@@ -1 +1 @@
-123830
\ No newline at end of file
+123749
\ No newline at end of file
diff --git a/.forge-snapshots/swap burn 6909 for input.snap b/.forge-snapshots/swap burn 6909 for input.snap
index a171521e6..a87b06372 100644
--- a/.forge-snapshots/swap burn 6909 for input.snap	
+++ b/.forge-snapshots/swap burn 6909 for input.snap	
@@ -1 +1 @@
-135862
\ No newline at end of file
+135781
\ No newline at end of file
diff --git a/.forge-snapshots/swap burn native 6909 for input.snap b/.forge-snapshots/swap burn native 6909 for input.snap
index 6c1c23791..6bb054282 100644
--- a/.forge-snapshots/swap burn native 6909 for input.snap	
+++ b/.forge-snapshots/swap burn native 6909 for input.snap	
@@ -1 +1 @@
-125079
\ No newline at end of file
+124998
\ No newline at end of file
diff --git a/.forge-snapshots/swap mint native output as 6909.snap b/.forge-snapshots/swap mint native output as 6909.snap
index cd1f8e576..0c08d7719 100644
--- a/.forge-snapshots/swap mint native output as 6909.snap	
+++ b/.forge-snapshots/swap mint native output as 6909.snap	
@@ -1 +1 @@
-147119
\ No newline at end of file
+147038
\ No newline at end of file
diff --git a/.forge-snapshots/swap mint output as 6909.snap b/.forge-snapshots/swap mint output as 6909.snap
index d62c63cdb..09de52397 100644
--- a/.forge-snapshots/swap mint output as 6909.snap	
+++ b/.forge-snapshots/swap mint output as 6909.snap	
@@ -1 +1 @@
-163781
\ No newline at end of file
+163619
\ No newline at end of file
diff --git a/.forge-snapshots/swap skips hook call if hook is caller.snap b/.forge-snapshots/swap skips hook call if hook is caller.snap
index 623ff624b..9967d6cd7 100644
--- a/.forge-snapshots/swap skips hook call if hook is caller.snap	
+++ b/.forge-snapshots/swap skips hook call if hook is caller.snap	
@@ -1 +1 @@
-222077
\ No newline at end of file
+221834
\ No newline at end of file
diff --git a/.forge-snapshots/swap with dynamic fee.snap b/.forge-snapshots/swap with dynamic fee.snap
index ec01325b0..ed3763810 100644
--- a/.forge-snapshots/swap with dynamic fee.snap	
+++ b/.forge-snapshots/swap with dynamic fee.snap	
@@ -1 +1 @@
-147982
\ No newline at end of file
+147820
\ No newline at end of file
diff --git a/.forge-snapshots/swap with hooks.snap b/.forge-snapshots/swap with hooks.snap
index 74397ef2c..25b45698e 100644
--- a/.forge-snapshots/swap with hooks.snap	
+++ b/.forge-snapshots/swap with hooks.snap	
@@ -1 +1 @@
-123842
\ No newline at end of file
+123761
\ No newline at end of file
diff --git a/.forge-snapshots/swap with lp fee and protocol fee.snap b/.forge-snapshots/swap with lp fee and protocol fee.snap
index 168b0eab7..897406b51 100644
--- a/.forge-snapshots/swap with lp fee and protocol fee.snap	
+++ b/.forge-snapshots/swap with lp fee and protocol fee.snap	
@@ -1 +1 @@
-180162
\ No newline at end of file
+180000
\ No newline at end of file
diff --git a/.forge-snapshots/swap with return dynamic fee.snap b/.forge-snapshots/swap with return dynamic fee.snap
index c7869eff5..bae52ae0b 100644
--- a/.forge-snapshots/swap with return dynamic fee.snap	
+++ b/.forge-snapshots/swap with return dynamic fee.snap	
@@ -1 +1 @@
-155841
\ No newline at end of file
+155679
\ No newline at end of file
diff --git a/.forge-snapshots/tickSpacingToMaxLiquidityPerTick_gasCost60TickSpacing.snap b/.forge-snapshots/tickSpacingToMaxLiquidityPerTick_gasCost60TickSpacing.snap
index 681cf043c..fb3518156 100644
--- a/.forge-snapshots/tickSpacingToMaxLiquidityPerTick_gasCost60TickSpacing.snap
+++ b/.forge-snapshots/tickSpacingToMaxLiquidityPerTick_gasCost60TickSpacing.snap
@@ -1 +1 @@
-192
\ No newline at end of file
+197
\ No newline at end of file
diff --git a/.forge-snapshots/tickSpacingToMaxLiquidityPerTick_gasCostMaxTickSpacing.snap b/.forge-snapshots/tickSpacingToMaxLiquidityPerTick_gasCostMaxTickSpacing.snap
index 681cf043c..fb3518156 100644
--- a/.forge-snapshots/tickSpacingToMaxLiquidityPerTick_gasCostMaxTickSpacing.snap
+++ b/.forge-snapshots/tickSpacingToMaxLiquidityPerTick_gasCostMaxTickSpacing.snap
@@ -1 +1 @@
-192
\ No newline at end of file
+197
\ No newline at end of file
diff --git a/.forge-snapshots/tickSpacingToMaxLiquidityPerTick_gasCostMinTickSpacing.snap b/.forge-snapshots/tickSpacingToMaxLiquidityPerTick_gasCostMinTickSpacing.snap
index 681cf043c..fb3518156 100644
--- a/.forge-snapshots/tickSpacingToMaxLiquidityPerTick_gasCostMinTickSpacing.snap
+++ b/.forge-snapshots/tickSpacingToMaxLiquidityPerTick_gasCostMinTickSpacing.snap
@@ -1 +1 @@
-192
\ No newline at end of file
+197
\ No newline at end of file
diff --git a/.forge-snapshots/update dynamic fee in before swap.snap b/.forge-snapshots/update dynamic fee in before swap.snap
index d53788bbd..983d762c3 100644
--- a/.forge-snapshots/update dynamic fee in before swap.snap	
+++ b/.forge-snapshots/update dynamic fee in before swap.snap	
@@ -1 +1 @@
-158444
\ No newline at end of file
+158282
\ No newline at end of file
diff --git a/src/libraries/TickMath.sol b/src/libraries/TickMath.sol
index 02758dce5..811abdf29 100644
--- a/src/libraries/TickMath.sol
+++ b/src/libraries/TickMath.sol
@@ -13,7 +13,7 @@ library TickMath {
     /// @dev The minimum tick that may be passed to #getSqrtPriceAtTick computed from log base 1.0001 of 2**-128
     int24 internal constant MIN_TICK = -887272;
     /// @dev The maximum tick that may be passed to #getSqrtPriceAtTick computed from log base 1.0001 of 2**128
-    int24 internal constant MAX_TICK = -MIN_TICK;
+    int24 internal constant MAX_TICK = 887272;
 
     /// @dev The minimum tick spacing value drawn from the range of type int16 that is greater than 0, i.e. min from the range [1, 32767]
     int24 internal constant MIN_TICK_SPACING = 1;
@@ -50,7 +50,15 @@ library TickMath {
     function getSqrtPriceAtTick(int24 tick) internal pure returns (uint160 sqrtPriceX96) {
         unchecked {
             uint256 absTick = tick < 0 ? uint256(-int256(tick)) : uint256(int256(tick));
-            if (absTick > uint256(int256(MAX_TICK))) revert InvalidTick();
+            /// @solidity memory-safe-assembly
+            assembly {
+                // Equivalent: if (absTick > MAX_TICK) revert InvalidTick();
+                if gt(absTick, MAX_TICK) {
+                    // store 4-byte selector of "InvalidTick()" at memory [0x1c, 0x20)
+                    mstore(0, 0xce8ef7fc)
+                    revert(0x1c, 0x04)
+                }
+            }
 
             uint256 price =
                 absTick & 0x1 != 0 ? 0xfffcb933bd6fad37aa2d162d1a594001 : 0x100000000000000000000000000000000;