Catalyst audit: M-01 missing overflow check from tryMul function.

packages/dependency-royalty-management/contracts/RoyaltySplitter.sol

@@ -158,6 +158,7 @@ contract RoyaltySplitter is
                     Recipient memory recipient = _recipients[i];
                     bool success;
                     (success, amountToSend) = balance.tryMul(recipient.bps);
+                    require(success, "RoyaltySplitter: Multiplication Overflow");
 
                     amountToSend /= TOTAL_BASIS_POINTS;
                     totalSent += amountToSend;

packages/dependency-royalty-management/contracts/mock/OverflowERC20.sol

@@ -0,0 +1,15 @@
+// SPDX-License-Identifier: MIT OR Apache-2.0
+pragma solidity ^0.8.0;
+
+contract OverflowTestERC20 {
+    uint256 constant MAX_BALANCE = 115792089237316195423570985008687907853269984665640564039457584007913129639935;
+    mapping(address => uint256) private balances;
+
+    function mintMax(address account) external {
+        balances[account] = MAX_BALANCE;
+    }
+
+    function balanceOf(address _account) external view returns (uint256) {
+        return balances[_account];
+    }
+}

packages/dependency-royalty-management/test/RoyaltyDistribution.test.ts

@@ -1934,6 +1934,43 @@ describe('Royalty', function () {
         )
       ).to.be.revertedWith('Manager: No splitter deployed for the creator');
     });
+
+    it('should revert on for overflow for try mul in splitter contract', async function () {
+      const {
+        ERC1155,
+        deployer,
+        seller,
+        royaltyReceiver,
+        RoyaltyManagerContract,
+      } = await royaltyDistribution();
+      await ERC1155.connect(deployer).mint(
+        seller.address,
+        1,
+        1,
+        royaltyReceiver.address,
+        '0x'
+      );
+      const TestERC20Factory = await ethers.getContractFactory(
+        'OverflowTestERC20'
+      );
+      const OverflowERC20 = await TestERC20Factory.deploy();
+
+      const splitter = await RoyaltyManagerContract._creatorRoyaltiesSplitter(
+        deployer.address
+      );
+
+      const splitterContract = await ethers.getContractAt(
+        splitterAbi,
+        splitter
+      );
+
+      await OverflowERC20.mintMax(splitter);
+      await expect(
+        splitterContract
+          .connect(royaltyReceiver)
+          .splitERC20Tokens(OverflowERC20.address)
+      ).to.be.revertedWith('RoyaltySplitter: Multiplication Overflow');
+    });
   });
 
   describe('Interfaces', function () {