fix: security audit fixes for PositionValue.sol

[rroland10]

Security Audit Report: PositionValue.sol

Summary

Comprehensive security audit of contracts/dex-periphery/base/PositionValue.sol — a library that computes total token value (principal + fees) for Uniswap V3 NFT positions. This PR addresses 5 vulnerabilities spanning missing imports, arithmetic overflow/underflow, and modular arithmetic mishandling.

---

Vulnerabilities Found & Fixes Applied

V-01: Missing FullMath Import (Severity: High — Compilation Reliability)

Location: Top-level imports
Description: The _fees() function calls FullMath.mulDiv() but FullMath is never explicitly imported. The library resolves only through transitive imports (via LiquidityAmounts.sol -> FullMath.sol), making compilation dependent on import ordering and internal compiler behavior. Any refactoring of upstream dependencies could silently break this contract.
Fix: Added explicit import '../../libraries/FullMath.sol'; import.

---

V-02: Arithmetic Overflow in total() (Severity: Medium)

Location: total() function, line 30
Original Code: return (amount0Principal + amount0Fee, amount1Principal + amount1Fee);
Description: In Solidity 0.7.6 (pre-0.8.0), the + operator does not have built-in overflow protection. If amount0Principal + amount0Fee exceeds type(uint256).max, the result silently wraps around to a much smaller number. While unlikely in normal operation, a position with extremely large fee accruals could trigger this, returning an incorrect (drastically underreported) total value.
Fix: Replaced raw + with LowGasSafeMath.add() which reverts on overflow:
return (amount0Principal.add(amount0Fee), amount1Principal.add(amount1Fee));

---

V-03: Fee Growth Underflow Revert in _fees() (Severity: High — Can Lock Fee Queries)

Location: _fees() function, lines 131 and 139
Original Code: poolFeeGrowthInside0LastX128 - feeParams.positionFeeGrowthInside0LastX128
Description: Uniswap V3 fee growth counters are designed to use modular (wrapping) arithmetic — they intentionally overflow and wrap around uint256. The core pool's Tick.getFeeGrowthInside() uses Solidity 0.7.6 behavior where subtraction wraps, but this library's _fees() function performs the same subtraction with checked arithmetic. When the pool's fee growth counter wraps around past uint256.max (by design), the subtraction pool - position underflows, causing the transaction to revert. This means fee queries become permanently broken for affected positions, effectively locking out any fee-dependent operations.
Fix: Use inline assembly for unchecked subtraction that correctly wraps on underflow, accessing positionFeeGrowthInside0LastX128 (offset 0xC0) and positionFeeGrowthInside1LastX128 (offset 0xE0) from the FeeParams memory struct.

---

V-04: Fee Growth Underflow Revert in _getFeeGrowthInside() (Severity: High — Can Lock Fee Queries)

Location: _getFeeGrowthInside() function, lines 155-165 (all three tick position branches)
Description: This is the same modular arithmetic issue as V-03 but in the fee growth inside calculation. The Uniswap V3 core Tick.sol library's getFeeGrowthInside() function relies on unsigned integer wrapping for these exact same subtractions (see core Tick.sol lines 68-94). The periphery's re-implementation uses checked subtraction in Solidity 0.7.6, which will revert when fee growth values wrap — exactly the scenario the core protocol was designed to handle.
Fix: Wrapped all three branches in assembly blocks for unchecked subtraction, matching the core Tick library's intended modular arithmetic behavior.

---

V-05: Arithmetic Overflow in _fees() Addition (Severity: Medium)

Location: _fees() function, lines 134 and 143
Original Code: FullMath.mulDiv(...) + feeParams.tokensOwed0;
Description: The addition of computed uncollected fees and previously owed tokens (tokensOwed0/tokensOwed1) uses raw + without overflow protection. While FullMath.mulDiv itself is safe, the subsequent addition could overflow if the combined value exceeds uint256.max, silently wrapping to an incorrect small value.
Fix: Replaced with LowGasSafeMath.add(): FullMath.mulDiv(...).add(feeParams.tokensOwed0);

---

Files Changed

File	Change
contracts/dex-periphery/base/PositionValue.sol	Added imports, SafeMath usage, assembly-based unchecked subtraction

Compilation Verification

• Verified that PositionValue.sol compiles cleanly with Solidity 0.7.6 (hardhat config)
• No new warnings or errors introduced
• Pre-existing compilation issues in Revenue_old.sol / RevenueV1.sol (pragma mismatch) and Dex223PoolLib.sol / MockTimeDex223Pool.sol (identifier errors) are not affected by this change

---

Test Plan

• Verify PositionValue.sol compiles without errors under Solidity 0.7.6
• Verify PositionValueTest.sol compiles and all existing tests pass
• Test total() with large principal + fee values near uint256.max to confirm overflow reverts correctly
• Test fees() with fee growth counters that have wrapped past uint256.max to verify correct modular arithmetic
• Test _getFeeGrowthInside() for all three tick position branches (tickCurrent < tickLower, tickLower <= tickCurrent < tickUpper, tickCurrent >= tickUpper) with wrapped fee growth values
• Test edge case: position with zero liquidity returns zero fees without revert
• Test edge case: position where pool fee growth equals position fee growth returns only tokensOwed amounts
• Verify no regression in gas costs by running totalGas(), principalGas(), and feesGas() from PositionValueTest.sol
• Confirm assembly memory offsets (0xC0, 0xE0) correctly access positionFeeGrowthInside0LastX128 and positionFeeGrowthInside1LastX128 in the FeeParams struct

[Dexaran]

V-01: Missing FullMath Import (Severity: High — Compilation Reliability)

I don't see any reason to dig into Uniswap's math since it works in production for years without any problems. We have higher chances of introducing bugs while trying to fix theoretical problems which don't cause any accidents in production.

V-02: Arithmetic Overflow in total() (Severity: Medium)

Works for years in Uniswap. Let's not make changes just for the sake of changing something.

V-03: Fee Growth Underflow Revert in _fees() (Severity: High — Can Lock Fee Queries)

Another report related to Uniswap's math...

V-05: Arithmetic Overflow in _fees() Addition (Severity: Medium)

Math...