PoolTogether Aave v3 contest - 0xf15ers's results

A protocol for no loss prize savings on Ethereum.

General Information

Platform: Code4rena

Start Date: 29/04/2022

Pot Size: $22,000 USDC

Total HM: 6

Participants: 40

Period: 3 days

Judge: Justin Goro

Total Solo HM: 2

Id: 114

League: ETH

PoolTogether

Findings Distribution

Researcher Performance

Rank: 17/40

Findings: 2

Award: $197.13

๐ŸŒŸ Selected for report: 0

๐Ÿš€ Solo Findings: 0

Findings Information

๐ŸŒŸ Selected for report: MaratCerby

Also found by: 0x52, 0xDjango, 0xf15ers, Dravee, GimelSec, IllIllI, Picodes, delfin454000, gzeon, hake, kebabsec, pauliax, reassor, z3s

Labels

bug
QA (Quality Assurance)
sponsor acknowledged

Awards

168.7819 USDC - $168.78

External Links

1. Change function mutability of balanceOfToken() to view:

2. Add Reentrancy Guard (nonReentrant)to transferERC20()

  • Although the call is restricted to only owner or Manager, using reentrancy guard is a good practice

#0 - PierrickGT

2022-05-03T21:44:15Z

  1. Change function mutability of balanceOfToken() to view:

As stated previously, we inherit from the yield source interface so we can't restrict this function to a view function.

  1. Add Reentrancy Guard (nonReentrant)to transferERC20()

As mentioned by the warden, since the call is restricted to only owner or Manager, the risk of a reentrancy attack is low and it wouldn't make sense to perform one here since a user can withdraw the max amount of tokens with this function.

#1 - gititGoro

2022-05-20T21:06:03Z

After discussion with Sponsor, a pull request has been created which alters the visibility to view with this PR https://github.com/pooltogether/aave-v3-yield-source/pull/16/commits/e583ca0bf31b35eaab9c4dd12872d94978afb408

Awards

28.3489 USDC - $28.35

Labels

bug
G (Gas Optimization)
sponsor acknowledged

External Links

1. Use custom error for gas optimisation

require(address(_aToken) != address(0), "AaveV3YS/aToken-not-zero-address");
require(address(_rewardsController) != address(0), "AaveV3YS/RC-not-zero-address");
require(address(_poolAddressesProviderRegistry) != address(0), "AaveV3YS/PR-not-zero-address");
require(_owner != address(0), "AaveV3YS/owner-not-zero-address");
require(decimals_ > 0, "AaveV3YS/decimals-gt-zero");
require(_shares > 0, "AaveV3YS/shares-gt-zero");
.....

2. >0 is less gas efficient than != 0 for uints

3. Reduce gas using modifiers instead of internal function (requiretoken())

modifier requireNotAToken(address _token) { require(_token != address(aToken), "AaveV3YS/forbid-aToken-allowance"); _; }

Before:

ยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยท|ยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยท|ยทยทยทยทยทยทยทยทยทยทยทยทยทยท|ยทยทยทยทยทยทยทยทยทยทยทยทยท|ยทยทยทยทยทยทยทยทยทยทยทยทยท|ยทยทยทยทยทยทยทยทยทยทยทยทยทยทยท|ยทยทยทยทยทยทยทยทยทยทยทยทยทยท | AaveV3YieldSourceHarness ยท decreaseERC20Allowance ยท 40154 ยท 42359 ยท 41620 ยท 3 ยท 11.59 โ”‚ ยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยท|ยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยท|ยทยทยทยทยทยทยทยทยทยทยทยทยทยท|ยทยทยทยทยทยทยทยทยทยทยทยทยท|ยทยทยทยทยทยทยทยทยทยทยทยทยท|ยทยทยทยทยทยทยทยทยทยทยทยทยทยทยท|ยทยทยทยทยทยทยทยทยทยทยทยทยทยท | AaveV3YieldSourceHarness ยท increaseERC20Allowance ยท 61935 ยท 64452 ยท 64041 ยท 7 ยท 17.84 โ”‚ ยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยท|ยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยท|ยทยทยทยทยทยทยทยทยทยทยทยทยทยท|ยทยทยทยทยทยทยทยทยทยทยทยทยท|ยทยทยทยทยทยทยทยทยทยทยทยทยท|ยทยทยทยทยทยทยทยทยทยทยทยทยทยทยท|ยทยทยทยทยทยทยทยทยทยทยทยทยทยท

After:

ยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยท|ยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยท|ยทยทยทยทยทยทยทยทยทยทยทยทยทยท|ยทยทยทยทยทยทยทยทยทยทยทยทยท|ยทยทยทยทยทยทยทยทยทยทยทยทยท|ยทยทยทยทยทยทยทยทยทยทยทยทยทยทยท|ยทยทยทยทยทยทยทยทยทยทยทยทยทยท | AaveV3YieldSourceHarness ยท decreaseERC20Allowance ยท 40130 ยท 42335 ยท 41596 ยท 3 ยท 11.58 โ”‚ ยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยท|ยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยท|ยทยทยทยทยทยทยทยทยทยทยทยทยทยท|ยทยทยทยทยทยทยทยทยทยทยทยทยท|ยทยทยทยทยทยทยทยทยทยทยทยทยท|ยทยทยทยทยทยทยทยทยทยทยทยทยทยทยท|ยทยทยทยทยทยทยทยทยทยทยทยทยทยท | AaveV3YieldSourceHarness ยท increaseERC20Allowance ยท 61911 ยท 64428 ยท 64017 ยท 7 ยท 17.82 โ”‚ ยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยท|ยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยท|ยทยทยทยทยทยทยทยทยทยทยทยทยทยท|ยทยทยทยทยทยทยทยทยทยทยทยทยท|ยทยทยทยทยทยทยทยทยทยทยทยทยท|ยทยทยทยทยทยทยทยทยทยทยทยทยทยทยท|ยทยทยทยทยทยทยทยทยทยทยทยทยทยท

#0 - PierrickGT

2022-05-03T21:36:26Z

Great report by warden, he should get extra points.

#1 - PierrickGT

2022-05-03T21:40:26Z

  1. Use custom error for gas optimisation

Duplicate of https://github.com/code-423n4/2022-04-pooltogether-findings/issues/13

  1. 0 is less gas efficient than != 0 for uints

Duplicate of https://github.com/code-423n4/2022-04-pooltogether-findings/issues/11

  1. Reduce gas using modifiers instead of internal function (requiretoken())

We prefer to use require for better code readability.

AuditHub

A portfolio for auditors, a security profile for protocols, a hub for web3 security.

Built bymalatrax ยฉ 2024

Auditors

Browse

Contests

Browse

Get in touch

ContactTwitter