Mimo DeFi contest - 0x1f8b's results

Lines of code

https://github.com/code-423n4/2022-04-mimo/blob/b18670f44d595483df2c0f76d1c57a7bfbfbc083/core/contracts/oracles/GUniLPOracle.sol#L47 https://github.com/code-423n4/2022-04-mimo/blob/b18670f44d595483df2c0f76d1c57a7bfbfbc083/core/contracts/oracles/GUniLPOracle.sol#L51

Vulnerability details

Impact

It is possible to produce underflows with specific tokens which can cause errors when calculating prices.

Proof of Concept

The pragma is pragma solidity 0.6.12; therefore, integer overflows must be protected with safe math. But in the case of GUniLPOracle, there is a decimal subtraction that could underflow if any token in the pool has more than 18 decimals. this could cause an error when calculating price values.

Recommended Mitigation Steps

Ensure that tokens have less than 18 decimals.

1. It was found some transfer, approve and transferFrom without checking the boolean result, ERC20 standard specify that the token can return false if this call was not made, so it's mandatory to check the result of these methods.

• SuperVault.sol#L97
• SuperVault.sol#L129
• SuperVault.sol#L149
• SuperVault.sol#L199
• SuperVault.sol#L237
• SuperVault.sol#L273-L274
• SuperVault.sol#L289-L290
• SuperVault.sol#L326
• SuperVault.sol#L345
• PARMinerV2.sol#L58
• PARMinerV2.sol#L125

1. Gas saving using immutable. It's possible to avoid storage access a save gas using immutable keyword for the following variables:

• base at SuperVaultFactory.sol#L15

2. Change the incremental logic from i++ to ++i in order to save some opcodes:

• DexAddressProvider.sol#L16
• AdminInceptionVault.sol#L108

3. It's possible to safe gas updating the outdated contract ABDKMath64x64, there are a lot of optimizations with unchecked regions.

• New commits: https://github.com/abdk-consulting/abdk-libraries-solidity/commits/master/ABDKMath64x64.sol