Ajna Protocol - BGSecurity's results

Lines of code

https://github.com/code-423n4/2023-05-ajna/blob/main/ajna-core/src/RewardsManager.sol#L815

Vulnerability details

Summary

Likelihood: Medium, because it requires rewardsEarned_ > ajnaBalance

Impact: Medium, because accounting might be wrong, which may lead to loss of funds for the ajnaToken or for the user, and unnecessary actions to perform _updateBucketExchangeRates and _updateBucketExchangeRateAndCalculateRewards would be executed anyways

Impact

Such implementation is in contrast with programming best practices and it'll force unnecessary additional actions to execute _updateBucketExchangeRates and _updateBucketExchangeRateAndCalculateRewards and can even lead to loss of funds in edge case scenarios.

Proof of Concept

https://github.com/code-423n4/2023-05-ajna/blob/main/ajna-core/src/RewardsManager.sol#L815

Tool Used

Manual Review

Recommended Mitigation Steps

The first choice is to redesign the logic to store the currently up-to-date users' rewards in the storage variable and perform calculations on it. Then if rewardsEarned_ > ajnaBalance check is true, you can subtract the user rewards with ajnaBalance in storage and execute the transfer. The second choice is to simply revert the transaction in case rewardsEarned_ > ajnaBalance, to prevent unexpected behavior.

Assessed type

Invalid Validation

Introduction

Ajna QA report was done by martin and anonresercher, with a main focus on the low severity and non-critical security aspects of the implementaion and logic of the project.

Findings Summary

The following issues were found, categorized by their severity:

Findings Summary

[L-01] Hardcoded Ajna token address

In case the addresses change due to reasons such as updating their versions in the future, addresses coded as constants cannot be updated. You can have a immutable variable containing the token address. And this variable can be set from a constructor.

So you can effectively pass the value from an environment variable to the contract constructor, to the contract storage.

21: address public immutable ajnaTokenAddress = 0x9a96ec9B57Fb64FbC60B423d1f4da7691Bd35079;

https://github.com/code-423n4/2023-05-ajna/blob/main/ajna-grants/src/grants/base/Funding.sol

[L-02] Function logic is misleadingly documented

The Nat Spec dev description assures that the function will iterate through maximum of 10 proposals, but actually it iterates through all of them in a nested loop.

458: * @dev    Only iterates through a maximum of 10 proposals that made it through the screening round.

[L-03] Redundant parameter reason in IFunding.VoteCast event

The reason parameter is set value as an empty string everywhere where event IFunding.VoteCast is emitted and should therefore be removed, because there is no use for it

https://github.com/code-423n4/2023-05-ajna/blob/main/ajna-grants/src/grants/interfaces/IFunding.sol#L69

/ajna-grants/src/grants/interfaces/IFunding.sol

69: event VoteCast(address indexed voter, uint256 proposalId, uint8 support, uint256 weight, string reason);

There are 3 instances of set reason value as an empty string:

https://github.com/code-423n4/2023-05-ajna/blob/main/ajna-grants/src/grants/base/ExtraordinaryFunding.sol#L155

https://github.com/code-423n4/2023-05-ajna/blob/main/ajna-grants/src/grants/base/StandardFunding.sol#L688

https://github.com/code-423n4/2023-05-ajna/blob/main/ajna-grants/src/grants/base/StandardFunding.sol#L751

[NC-01] emit function called early

The event is actually emitted before the action, event emits should be moved after the action. Otherwise, it might cause an incorrectly emitted event.

59: emit ProposalExecuted(proposalId_);

https://github.com/code-423n4/2023-05-ajna/blob/main/ajna-grants/src/grants/base/Funding.sol

In case safeTransfer fails the DelegateRewardClaimed event would still be called.

https://github.com/code-423n4/2023-05-ajna/blob/main/ajna-grants/src/grants/base/StandardFunding.sol#L257

In case safeTransferFrom fails the FundTreasury event would still be called.

https://github.com/code-423n4/2023-05-ajna/blob/ main/ajna-grants/src/grants/GrantFund.sol#L64

https://github.com/code-423n4/2023-05-ajna/blob/main/ajna-core/src/RewardsManager.sol#L299

https://github.com/code-423n4/2023-05-ajna/blob/main/ajna-core/src/RewardsManager.sol#L585

[NC-02] Bad formatting

https://github.com/code-423n4/2023-05-ajna/blob/main/ajna-grants/src/grants/base/Funding.sol

https://github.com/code-423n4/2023-05-ajna/blob/main/ajna-grants/src/grants/base/ExtraordinaryFunding.sol

https://github.com/code-423n4/2023-05-ajna/blob/main/ajna-grants/src/grants/base/ExtraordinaryFunding.sol

https://github.com/code-423n4/2023-05-ajna/blob/main/ajna-grants/src/grants/base/StandardFunding.sol

https://github.com/code-423n4/2023-05-ajna/blob/main/ajna-grants/src/grants/GrantFund.sol

https://github.com/code-423n4/2023-05-ajna/blob/main/ajna-core/src/PositionManager.sol

https://github.com/code-423n4/2023-05-ajna/blob/main/ajna-core/src/RewardsManager.sol