Platform: Code4rena
Start Date: 04/11/2021
Pot Size: $50,000 USDC
Total HM: 20
Participants: 28
Period: 7 days
Judge: 0xean
Total Solo HM: 11
Id: 51
League: ETH
Rank: 14/28
Findings: 3
Award: $706.36
🌟 Selected for report: 3
🚀 Solo Findings: 0
0v3rf10w
Unchecked transfer leading to free deposits to attacker account
function :: BasicSale._processWithdrawal(uint256,uint256,address) (tge/contracts/PublicSale.sol#212-229)
Several tokens do not revert in case of failure and return false. The return value of transfer mainToken.transfer(_member,v_value) (tge/contracts/PublicSale.sol#224) is not checked, and so if deposit will not revert if the transfer fails, and an attacker can call deposit for free.
Manual
Return value needs to checked or use SafeREC20
#0 - chickenpie347
2021-11-16T14:06:01Z
Addressed in #31.
392.5282 USDC - $392.53
0v3rf10w
Unchecked low-level calls
Unchecked cases at 2 places :- BasicSale.receive() (2021-11-bootfinance/tge/contracts/PublicSale.sol#148-156) ignores return value by burnAddress.call{value: msg.value}() (2021-11-bootfinance/tge/contracts/PublicSale.sol#154)
BasicSale.burnEtherForMember(address) (2021-11-bootfinance/tge/contracts/PublicSale.sol#158-166) ignores return value by burnAddress.call{value: msg.value}() (2021-11-bootfinance/tge/contracts/PublicSale.sol#164)
Manual
The return value of the low-level call is not checked, so if the call fails, the Ether will be locked in the contract. If the low level is used to prevent blocking operations, consider logging failed calls.
130.8427 USDC - $130.84
0v3rf10w
Missing Zero address check
BasicSale.constructor(IERC20,IERC721,IVesting,uint256,uint256,uint256,uint256,address)._burnAddress (tge/contracts/PublicSale.sol#112) lacks a zero-check on :- burnAddress = _burnAddress (tge/contracts/PublicSale.sol#137)
Manual
Check that the address is zero
130.8427 USDC - $130.84
0v3rf10w
Multiple Reentrancy
Reentrancy in BasicSale.receive() (tge/contracts/PublicSale.sol#148-156)
Reentrancy in BasicSale.burnEtherForMember(address) (tge/contracts/PublicSale.sol#158-166)
State variables written after the external call(s) in all above.
Manual