Skip to main content

Incorrect exponentiation

Description​

The operator ^ is not an exponential operator, it is a bitwise XOR. Make sure to use pow() instead for exponentiation. In case of performing a XOR operation, use .bitxor() for clarity.

Why is it bad?​

It can produce unexpected behaviour in the smart contract.

Issue example​

In the following example, the ^ operand is being used for exponentiation. But in Rust, ^ is the operand for an XOR operation. If misused, this could lead to unexpected behaviour in our contract.

Consider the following Soroban contract:

   pub fn exp_data_3(e: Env) -> u128 {
        let mut data = e.storage()
        .instance()
        .get::<DataKey, u128>(&DataKey::Data)
        .expect("Data not found");

        data ^= 3;
        data
    }

The code example can be found here.

Remediated example​

A possible solution is to use the method pow(). But, if a XOR operation is wanted, .bitxor() method is recommended.

    pub fn exp_data_3(e: Env) -> u128 {
        let data = e.storage()
        .instance()
        .get::<DataKey, u128>(&DataKey::Data)
        .expect("Data not found");

        data.pow(3)
    }

The remediated code example can be found here.

How is it detected?​

Warns about ^ being a bit XOR operation instead of an exponentiation.

References​