Ondo Finance contest - 2997ms's results

Summary

Low Risk Issues

Non-critical Issues

Low Risk Issues

[LOW-01] The divisor may be 0

We don't have the validtion of epochDuration value. If epochDuration is 0, the flow will be reverted without a valid error message.

Proof Of Concept https://github.com/code-423n4/2023-01-ondo/blob/main/contracts/cash/CashManager.sol#L176

Recommended Mitigation Steps Add a validation of this value to make sure it is not 0.

[LOW-02] Validate the cash decimals >= collateral decimals.

In the annotation, we assume ````cash decimals >= collateral decimals```, but actually we need one line to validate it.

Proof Of Concept

https://github.com/code-423n4/2023-01-ondo/blob/main/contracts/cash/CashManager.sol#L178-L182

Recommended Mitigation Steps

Validate the cash decimals >= collateral decimals.

Non Critical Issues

[NC-01]Stop using V == 27 || V == 28

Proof Of Concept

https://github.com/code-423n4/2023-01-ondo/blob/main/contracts/cash/kyc/KYCRegistry.sol#L87

Recommended Mitigation Steps See this reference: https://twitter.com/alexberegszaszi/status/1534461421454606336?s=20&t=H0Dv3ZT2bicx00hLWJk7Fg

[NC-02]Lines are too long

Usually lines in source code are limited to 80 characters. Today’s screens are much larger so it’s reasonable to stretch this in some cases. Since the files will most likely reside in GitHub, and GitHub starts using a scroll bar in all cases when the length is over 164 characters, the lines below should be split when they reach that length.

Reference: https://docs.soliditylang.org/en/v0.8.10/style-guide.html#maximum-line-length

Proof Of Concept

https://github.com/code-423n4/2023-01-ondo/blob/main/contracts/lending/tokens/cToken/CTokenModified.sol#L573-L574

Recommended Mitigation Steps Follow the recommended solidity doc and reduce the lengths of codes.

[NC-03]Solidity versions should be consistent

Most of solidity versions in the files are pragma solidity 0.8.16;, but in cErc20ModifiedDelegator.sol, the value is pragma solidity ^0.5.12;

Proof Of Concept

https://github.com/code-423n4/2023-01-ondo/blob/main/contracts/lending/tokens/cErc20ModifiedDelegator.sol Recommended Mitigation Steps Make the versions consistent

[NC-04]No same value input control

  function setMintFee(
    uint256 _mintFee
  ) external override onlyRole(MANAGER_ADMIN) {
    if (_mintFee >= BPS_DENOMINATOR) {
      revert MintFeeTooLarge();
    }
    uint256 oldMintFee = mintFee;
    mintFee = _mintFee;
    emit MintFeeSet(oldMintFee, _mintFee);
  }

Recommended Mitigation Steps Add code like this; if (mintFee ==_mintFee);

[NC-05] Check the Address 0

  function setFeeRecipient(
    address _feeRecipient
  ) external override onlyRole(MANAGER_ADMIN) {
    address oldFeeRecipient = feeRecipient;
    feeRecipient = _feeRecipient;
    emit FeeRecipientSet(oldFeeRecipient, _feeRecipient);
  }

Recommended Mitigation Steps if(_feeRecipient == address(0)) revert;