audit(12): Long-term orders may be filled with an incorrect amount

.forge-snapshots/Base-V3DutchOrder-BaseExecuteSingleWithFee.snap

@@ -1 +1 @@
-198780
+198736

.forge-snapshots/Base-V3DutchOrder-ExecuteBatch.snap

@@ -1 +1 @@
-231116
+231028

.forge-snapshots/Base-V3DutchOrder-ExecuteBatchMultipleOutputs.snap

@@ -1 +1 @@
-244626
+244516

.forge-snapshots/Base-V3DutchOrder-ExecuteBatchMultipleOutputsDifferentTokens.snap

@@ -1 +1 @@
-302041
+301909

.forge-snapshots/Base-V3DutchOrder-ExecuteBatchNativeOutput.snap

@@ -1 +1 @@
-224642
+224554

.forge-snapshots/Base-V3DutchOrder-ExecuteSingle.snap

@@ -1 +1 @@
-165165
+165121

.forge-snapshots/Base-V3DutchOrder-ExecuteSingleNativeOutput.snap

@@ -1 +1 @@
-150727
+150683

.forge-snapshots/Base-V3DutchOrder-ExecuteSingleValidation.snap

@@ -1 +1 @@
-174481
+174437

.forge-snapshots/Base-V3DutchOrder-RevertInvalidNonce.snap

@@ -1 +1 @@
-43785
+43741

.forge-snapshots/Base-V3DutchOrder-V3-ExclusiveFiller.snap

@@ -1 +1 @@
-169089
+169045

.forge-snapshots/Base-V3DutchOrder-V3-InputOverride.snap

@@ -1 +1 @@
-169170
+169126

.forge-snapshots/Base-V3DutchOrder-V3-OutputOverride.snap

@@ -1 +1 @@
-169113
+169069

.forge-snapshots/V3-DutchDecay.snap

@@ -1 +1 @@
-13179
+13419

.forge-snapshots/V3-DutchDecayBounded.snap

@@ -1 +1 @@
-1199
+1193

.forge-snapshots/V3-DutchDecayFullyDecayed.snap

@@ -1 +1 @@
-6677
+6803

.forge-snapshots/V3-DutchDecayFullyDecayedNegative.snap

@@ -1 +1 @@
-6365
+6491

.forge-snapshots/V3-DutchDecayNegative.snap

@@ -1 +1 @@
-1271
+1265

.forge-snapshots/V3-DutchDecayNoDecayYet.snap

@@ -1 +1 @@
-4703
+4697

.forge-snapshots/V3-DutchDecayNoDecayYetNegative.snap

@@ -1 +1 @@
-4703
+4697

.forge-snapshots/V3-DutchDecayRange.snap

@@ -1 +1 @@
-1271
+1265

.forge-snapshots/V3-ExtendedMultiPointDutchDecay.snap

@@ -1 +1 @@
-88354
+89554

.forge-snapshots/V3-MultiPointDutchDecay.snap

@@ -1 +1 @@
-26242
+26725

src/lib/NonlinearDutchDecayLib.sol

@@ -39,7 +39,8 @@ library NonlinearDutchDecayLib {
         if (decayStartBlock >= block.number || curve.relativeAmounts.length == 0) {
             return startAmount.bound(minAmount, maxAmount);
         }
-
+        // If the blockDelta is larger than type(uint16).max, a downcast overflow will occur
+        // We prevent this by capping the blockDelta to type(uint16).max to express a full decay
         uint16 blockDelta = uint16(Math.min(block.number - decayStartBlock, type(uint16).max));
         (uint16 startPoint, uint16 endPoint, int256 relStartAmount, int256 relEndAmount) =
             locateCurvePosition(curve, blockDelta);

test/lib/NonLinearDutchDecayLib.t.sol

@@ -8,6 +8,7 @@ import {DutchDecayLib} from "../../src/lib/DutchDecayLib.sol";
 import {NonlinearDutchDecayLib} from "../../src/lib/NonlinearDutchDecayLib.sol";
 import {V3DutchOutput, V3DutchInput, NonlinearDutchDecay} from "../../src/lib/V3DutchOrderLib.sol";
 import {Uint16Array, toUint256} from "../../src/types/Uint16Array.sol";
+import {Math} from "openzeppelin-contracts/utils/math/Math.sol";
 import {ArrayBuilder} from "../util/ArrayBuilder.sol";
 import {CurveBuilder} from "../util/CurveBuilder.sol";
 
@@ -476,21 +477,27 @@ contract NonlinearDutchDecayLibTest is Test, GasSnapshot {
     }
 
     function testFuzzDutchDecayBeyondUint16Max(
+        uint16 lastValidBlock, // For curve
+        uint256 decayAmountFuzz, // For curve
+        // decay(curve, startAmount, decayStartBlock, minAmount, maxAmount);
         uint256 startAmount,
-        uint256 blockDelta,
-        uint16 lastValidBlock,
-        uint256 decayAmountFuzz
+        uint256 decayStartBlock,
+        uint256 minAmount,
+        uint256 maxAmount,
+        uint256 currentBlock
     ) public {
-        uint256 decayStartBlock = 100;
+        vm.assume(decayStartBlock < type(uint256).max - type(uint16).max);
         vm.assume(lastValidBlock > 0);
-        vm.assume(startAmount > 0);
+        vm.assume(startAmount > 0 && startAmount < uint256(type(int256).max));
+        vm.assume(maxAmount >= startAmount);
+        minAmount = bound(minAmount, 0, startAmount);
+        // bound only takes uint256, so we need to limit decayAmountFuzz to int256.max
+        // because we cast it to int256 in the decay function
+        decayAmountFuzz = bound(decayAmountFuzz, minAmount, startAmount);
 
         // Testing that we get a fully decayed curve instead of overflowed mistake
-        vm.assume(blockDelta > uint256(type(uint16).max));
-        vm.assume(blockDelta < type(uint256).max - decayStartBlock);
-
-        // Bound decayAmountFuzz between 0 and startAmount
-        decayAmountFuzz = bound(decayAmountFuzz, 0, startAmount);
+        // This will happen when the block delta is larger than type(uint16).max
+        vm.assume(currentBlock > decayStartBlock + type(uint16).max);
 
         uint16[] memory blocks = new uint16[](1);
         blocks[0] = lastValidBlock;
@@ -500,10 +507,12 @@ contract NonlinearDutchDecayLibTest is Test, GasSnapshot {
 
         NonlinearDutchDecay memory curve = CurveBuilder.multiPointCurve(blocks, decayAmounts);
 
-        uint256 currentBlock = decayStartBlock + blockDelta;
         vm.roll(currentBlock);
-        uint256 decayed = NonlinearDutchDecayLib.decay(curve, startAmount, decayStartBlock, 0, startAmount);
-
-        assertEq(decayed, startAmount - decayAmountFuzz, "Should be fully decayed for block delta beyond uint16.max");
+        uint256 decayed = NonlinearDutchDecayLib.decay(curve, startAmount, decayStartBlock, minAmount, maxAmount);
+        assertEq(
+            decayed,
+            Math.max(startAmount - decayAmountFuzz, minAmount),
+            "Should be fully decayed for block delta beyond uint16.max"
+        );
     }
 }