Back to Bnke0x0's contests

Swivel v3 contest - Bnke0x0's results

The Capital-Efficient Protocol For Fixed-Rate Lending.

General Information

Platform: Code4rena

Start Date: 12/07/2022

Pot Size: $35,000 USDC

Total HM: 13

Participants: 78

Period: 3 days

Judge: 0xean

Total Solo HM: 6

Id: 135

League: ETH

Swivel

Findings Distribution

Researcher Performance

Rank: 30/78

Findings: 2

Award: $103.42

🌟 Selected for report: 0

🚀 Solo Findings: 0

External Links

Code4rena Contest PageGithub Contest RepositoryGithub Findings RepositorySwivel

Findings Information

🌟 Selected for report: joestakey

Also found by: 0x1f8b, 0x52, 0xDjango, 0xNazgul, 0xNineDec, 8olidity, Avci, Bahurum, Bnke0x0, Chom, ElKu, Funen, GimelSec, JC, Junnon, Kaiziron, Meera, PaludoX0, Picodes, ReyAdmirado, Sm4rty, Soosh, Waze, _Adam, __141345__, ak1, aysha, benbaessler, bin2chen, c3phas, cccz, cryptphi, csanuragjain, defsec, exd0tpy, fatherOfBlocks, gogo, hake, hansfriese, itsmeSTYJ, jonatascm, kyteg, mektigboy, oyc_109, pashov, rbserver, rishabh, robee, rokinot, sach1r0, sashik_eth, scaraven, simon135, slywaters

Awards

52.6366 USDC - $52.64

Labels

bug
duplicate
QA (Quality Assurance)
wontfix

External Links

Link to GitHub issue

[N-01] Adding a return statement when the function defines a named return variable, is redundant:-

1. File: 2022-07-swivel/Marketplace/MarketPlace.sol (line 207):

    `return interest;`         

2. File: 2022-07-swivel/Marketplace/MarketPlace.sol (line 166):

    `return (amount);`

3. File: 2022-07-swivel/Swivel/Hash.sol (line 74):

    `return hash;`

[N-02] constants should be defined rather than using magic numbers:-

1. File: 2022-07-swivel/Creator/VaultTracker.sol (line 224-227):

    `yield = ((maturityRate * 1e26) / sVault.exchangeRate) - 1e26;
} else {
    yield = ((exchangeRate * 1e26) / sVault.exchangeRate) - 1e26;
}`         

2. File: 2022-07-swivel/Marketplace/FixedPointMathLib.sol (line 61):

    `int256 k = ((x << 96) / 54916777467707473351141471128 + 2**95) >> 96;`

3. File: 2022-07-swivel/Marketplace/FixedPointMathLib.sol (line 56):

    `x = (x << 78) / 5**18;`

[N-03] Use a solidity version of at least 0.8.12 to get string.concat() to be used instead of abi.encodePacked(<str>,<str>):-

1. File: 2022-07-swivel/Creator/Erc20.sol (line 4):

    `pragma solidity ^0.8.0;`         

2. File: 2022-07-swivel/Marketplace/Erc20.sol (line 4):

    `pragma solidity ^0.8.0;`

3. File: 2022-07-swivel/Tokens/FixedPointMathLib.sol (line 2):

    `pragma solidity ^0.8.0;`

[N-04] Use a solidity version of at least 0.8.12 to get string.concat() to be used instead of abi.encodePacked(<str>,<str>):-

1. File: 2022-07-swivel/Creator/Erc20.sol (line 15-17):

    `  event Transfer(address indexed from, address indexed to, uint256 amount);

event Approval(address indexed owner, address indexed spender, uint256 amount);`

2. File: 2022-07-swivel/Creator/IERC5095.sol (line 6):

    `event Redeem(address indexed from, address indexed to, uint256 amount);`

3. File: 2022-07-swivel/Creator/Interfaces.sol (line 20-21):

    `event Transfer(address indexed from, address indexed to, uint256 value);

event Approval(address indexed owner, address indexed spender, uint256 value);`

4. File: 2022-07-swivel/Marketplace/Erc20.sol (line 15-17):

    ` event Transfer(address indexed from, address indexed to, uint256 amount);

event Approval(address indexed owner, address indexed spender, uint256 amount);`

5. File: 2022-07-swivel/Creator/IERC5095.sol (line 6-7):

    `event Transfer(address indexed from, address indexed to, uint256 value);

event Approval(address indexed owner, address indexed spender, uint256 value);`

6. File: 2022-07-swivel/Tokens/IERC5095.sol (line 6):

    `event Redeem(address indexed from, address indexed to, uint256 amount);` 

7. File: 2022-07-swivel/Tokens/Interfaces.sol (line 20-21):

    `  event Transfer(address indexed from, address indexed to, uint256 value);

event Approval(address indexed owner, address indexed spender, uint256 value);`

8. File: 2022-07-swivel/VaultTracker/Interfaces.sol (line 20-21):

    `event Transfer(address indexed from, address indexed to, uint256 value);

event Approval(address indexed owner, address indexed spender, uint256 value);`

[N-05] Missing checks for address(0x0) when assigning values to address state variables:-

1. File: 2022-07-swivel/Creator/VaultTracker.sol (line 35-36):

    `cTokenAddr = c;

swivel = s;`

#0 - robrobbins

2022-08-31T00:29:07Z

issues either addressed in other tickets or wontfixes

Findings Information

🌟 Selected for report: joestakey

Also found by: 0x040, 0x1f8b, 0xDjango, 0xNazgul, 0xsam, Avci, Aymen0909, Bnke0x0, CRYP70, ElKu, Fitraldys, Funen, JC, Kaiziron, MadWookie, Meera, ReyAdmirado, Sm4rty, Soosh, TomJ, Waze, _Adam, __141345__, ajtra, benbaessler, c3phas, csanuragjain, durianSausage, exd0tpy, fatherOfBlocks, hake, ignacio, karanctf, kyteg, m_Rassska, oyc_109, rbserver, robee, rokinot, samruna, sashik_eth, simon135, slywaters

Awards

50.7778 USDC - $50.78

Labels

bug
duplicate
G (Gas Optimization)
wontfix

External Links

Link to GitHub issue

[G-01] State variables only set in the constructor should be declared immutable (Avoids a Gsset (20000 gas)):-

1. File: 2022-07-swivel/Creator/Creator.sol (line 14-15):

    `address public admin;

address public marketPlace;`

[G-02] x = x + y is cheaper than x += y:-

1. File: 2022-07-swivel/Creator/Erc20.sol (line 87):

    `balanceOf[msg.sender] -= amount;`         

2. File: 2022-07-swivel/Creator/Erc20.sol (line 109):

    `balanceOf[from] -= amount;`

3. File: 2022-07-swivel/Creator/Erc20.sol (line 209):

    `alanceOf[from] -= amount;`

4. 2022-07-swivel/Creator/Erc20.sol (line 214):

    `totalSupply -= amount;`         

5. File: 2022-07-swivel/Creator/VaultTracker.sol (line 103):

    `vlt.notional -= a;`

6. File: 2022-07-swivel/Creator/VaultTracker.sol (line 175):

    `from.notional -= a;` 

7. File: 2022-07-swivel/Creator/VaultTracker.sol(line 213):

    `oVault.notional -= a;`         

8. File: 2022-07-swivel/Creator/ZcToken.sol (line 115):

    `allowance[holder][msg.sender] -= previewAmount;`

9. File: 2022-07-swivel/Creator/ZcToken.sol (line 134):

    `llowance[holder][msg.sender] -= principalAmount;`         

10. File: 2022-07-swivel/Marketplace/Erc20.sol (line 87):

    `balanceOf[from] -= amount;`

11. File: 2022-07-swivel/Marketplace/Erc20.sol (line 109):

    `balanceOf[from] -= amount;`

12. 2022-07-swivel/Marketplace/Erc20.sol (line 209):

    `balanceOf[from] -= amount;`         

13. File: 2022-07-swivel/Marketplace/Erc20.sol (line 214):

    `totalSupply -= amount;`

14. File: 2022-07-swivel/Tokens/Erc20.sol (line 87):

    `balanceOf[from] -= amount;`

15. File: 2022-07-swivel/Tokens/Erc20.sol (line 109):

    `balanceOf[from] -= amount;`

16. File: 2022-07-swivel/Tokens/Erc20.sol (line 209):

    `balanceOf[from] -= amount;`         

17. File: 2022-07-swivel/Tokens/Erc20.sol (line 214):

    `totalSupply -= amount;`     

18. File: 2022-07-swivel/VaultTracker/VaultTracker.sol (line 103):

    `vlt.notional -= a;`

19. File: 2022-07-swivel/VaultTracker/VaultTracker.sol (line 175):

    `from.notional -= a;`         

20. File: 2022-07-swivel/VaultTracker/VaultTracker.sol (line 213):

    `oVault.notional -= a;`               

21. File: 2022-07-swivel/Creator/Erc20.sol (line 92):

    `balanceOf[to] += amount;`         

22. File: 2022-07-swivel/Creator/Erc20.sol (line 114):

    `balanceOf[to] += amount;`

23. File: 2022-07-swivel/Creator/Erc20.sol (line 197):

    `totalSupply += amount;`

24. File: 2022-07-swivel/Creator/Erc20.sol (line 202):

    `balanceOf[to] += amount;`         

25. File: 2022-07-swivel/Marketplace/Erc20.sol (line 92):

    `balanceOf[to] += amount;`

26. File: 2022-07-swivel/Marketplace/Erc20.sol (line 114):

    `balanceOf[to] += amount;` 

27. File: 2022-07-swivel/Marketplace/Erc20.sol (line 197):

    `totalSupply += amount;`         

28. File: 2022-07-swivel/Marketplace/Erc20.sol (line 202):

    `balanceOf[to] += amount;`

29. File: 2022-07-swivel/Tokens/Erc20.sol (line 92):

    `balanceOf[to] += amount;`

30. File: 2022-07-swivel/Tokens/Erc20.sol (line 114):

    `balanceOf[to] += amount;` 

31. File: 2022-07-swivel/Tokens/Erc20.sol (line 197):

    `totalSupply += amount;`         

32. File: 2022-07-swivel/Tokens/Erc20.sol (line 202):

    `balanceOf[to] += amount;`

[G-03] require() or revert() statements that check input arguments should be at the top of the function:-

1. File: 2022-07-swivel/Creator/LibCompound.sol (line 28):

    `require(borrowRateMantissa <= 0.0005e16, "RATE_TOO_HIGH"); `         

2. File: 2022-07-swivel/Creator/LibFuse.sol (line 36):

    `require(borrowRateMantissa <= 0.0005e16, "RATE_TOO_HIGH");`

3. File: 2022-07-swivel/Tokens/LibCompound.sol (line 28):

    `require(borrowRateMantissa <= 0.0005e16, "RATE_TOO_HIGH");`

4. 2022-07-swivel/Tokens/LibFuse.sol (line 36):

    `require(borrowRateMantissa <= 0.0005e16, "RATE_TOO_HIGH");`         

5. File: 2022-07-swivel/VaultTracker/LibCompound.sol (line 28):

    `require(borrowRateMantissa <= 0.0005e16, "RATE_TOO_HIGH"); `

6. File: 2022-07-swivel/VaultTracker/LibFuse.sol (line 36):

    `require(borrowRateMantissa <= 0.0005e16, "RATE_TOO_HIGH");`

[G-04] Use custom errors rather than revert()/require() strings to save deployment gas:-

1. File: 2022-07-swivel/Creator/LibCompound.sol (line 28):

    `require(borrowRateMantissa <= 0.0005e16, "RATE_TOO_HIGH"); `         

2. File: 2022-07-swivel/Creator/LibFuse.sol (line 36):

    `require(borrowRateMantissa <= 0.0005e16, "RATE_TOO_HIGH");`

3. File: 2022-07-swivel/Tokens/LibCompound.sol (line 28):

    `require(borrowRateMantissa <= 0.0005e16, "RATE_TOO_HIGH");`

4. 2022-07-swivel/Tokens/LibFuse.sol (line 36):

    `require(borrowRateMantissa <= 0.0005e16, "RATE_TOO_HIGH");`         

5. File: 2022-07-swivel/VaultTracker/LibCompound.sol (line 28):

    `require(borrowRateMantissa <= 0.0005e16, "RATE_TOO_HIGH"); `

6. File: 2022-07-swivel/VaultTracker/LibFuse.sol (line 36):

    `require(borrowRateMantissa <= 0.0005e16, "RATE_TOO_HIGH");`

[G-05] Functions guaranteed to revert when called by normal users can be marked payable (If a function modifier such as onlyOwner is used, the function will revert if a normal user tries to pay the function. Marking the function as payable will lower the gas cost for legitimate callers because the compiler will not include checks for whether a payment was provided.):-

1. File: 2022-07-swivel/Creator/ZcToken.sol (line 140):

    `function burn(address f, uint256 a) external onlyAdmin(address(redeemer)) returns (bool) {`         

2. File: 2022-07-swivel/Creator/ZcToken.sol (line 147):

    `function mint(address t, uint256 a) external onlyAdmin(address(redeemer)) returns (bool) {`

[G-06] Use a more recent version of solidity (Use a solidity version of at least 0.8.15 to have external calls skip contract existence checks if the external call has a return value):-

1. File: 2022-07-swivel/Creator/Compounding.sol (line 3):

    `pragma solidity 0.8.13;`         

2. File: 2022-07-swivel/Creator/Creator.sol (line 3):

    `pragma solidity 0.8.13;`

3. File: 2022-07-swivel/Creator/Erc20.sol (line 4):

    `pragma solidity 0.8.0;`

4. 2022-07-swivel/Creator/FixedPointMathLib.sol (line 2):

    `pragma solidity 0.8.0;`         

5. File: 2022-07-swivel/Creator/IERC5095.sol (line 2):

    `pragma solidity 0.8.0;`

6. File: 2022-07-swivel/Creator/IRedeemer.sol (line 2):

    `pragma solidity 0.8.0;` 

7. File: 2022-07-swivel/Creator/Interfaces.sol (line 3):

    `pragma solidity 0.8.13;`         

8. File: 2022-07-swivel/Creator/LibCompound.sol (line 2):

    `pragma solidity 0.8.4;`

9. File: 2022-07-swivel/Creator/LibFuse.sol (line 1):

    `pragma solidity 0.8.13;`         

10. File: 2022-07-swivel/Creator/Protocols.sol (line 3):

    `pragma solidity 0.8.13;`

11. File: 2022-07-swivel/Creator/VaultTracker.sol (line 3):

    `pragma solidity 0.8.13;`

12. 2022-07-swivel/Creator/ZcToken.sol (line 2):

    `pragma solidity 0.8.4;`         

13. File: 2022-07-swivel/Marketplace/Compounding.sol (line 3):

    `pragma solidity 0.8.13;`

14. File: 2022-07-swivel/Marketplace/Erc20.sol (line 4):

    `pragma solidity 0.8.0;`

15. File: 2022-07-swivel/Marketplace/FixedPointMathLib.sol (line 2):

    `pragma solidity 0.8.0;`

16. File: 2022-07-swivel/Marketplace/Interfaces.sol (line 3):

    `pragma solidity 0.8.13;`         

17. File: 2022-07-swivel/Marketplace/LibCompound.sol (line 2):

    `pragma solidity 0.8.4;`     

18. File: 2022-07-swivel/Marketplace/LibFuse.sol (line 1):

    `pragma solidity 0.8.13;`

19. File: 2022-07-swivel/Marketplace/MarketPlace.sol (line 3):

    `pragma solidity 0.8.13;`         

20. File: 2022-07-swivel/Marketplace/Protocols.sol (line 3):

    `pragma solidity 0.8.13;`               

21. File: 2022-07-swivel/Swivel/Hash.sol (line 3):

    `pragma solidity 0.8.13;`         

22. File: 2022-07-swivel/Swivel/Interfaces.sol (line 3):

    `pragma solidity 0.8.13;`

23. File: 022-07-swivel/Swivel/Protocols.sol (line 3):

    `pragma solidity 0.8.13;`

24. File: 2022-07-swivel/Swivel/Safe.sol (line 3):

    `pragma solidity 0.8.13;`         

25. File: 2022-07-swivel/Swivel/Sig.sol (line 3):

    `pragma solidity 0.8.13;`

26. File: 2022-07-swivel/Swivel/Swivel.sol (line 3):

    `pragma solidity 0.8.13;` 

27. File: 2022-07-swivel/Tokens/Compounding.sol (line 3):

    `pragma solidity 0.8.13;`         

28. File: 2022-07-swivel/Tokens/Erc20.sol (line 4):

    `pragma solidity 0.8.0;`

29. File: 2022-07-swivel/Tokens/FixedPointMathLib.sol (line 2):

    `pragma solidity 0.8.0;`

30. File: 2022-07-swivel/Tokens/IERC5095.sol (line 2):

    `pragma solidity 0.8.0;` 

31. File: 2022-07-swivel/Tokens/IRedeemer.sol (line 2):

    `pragma solidity 0.8.0;`         

32. File: 2022-07-swivel/Tokens/Interfaces.sol (line 3):

    `pragma solidity 0.8.13;`         

33. File: 2022-07-swivel/Tokens/LibCompound.sol (line 2):

    `pragma solidity 0.8.4;`               

34. File: 2022-07-swivel/Tokens/LibFuse.sol (line 1):

    `pragma solidity 0.8.13;`         

35. File: 2022-07-swivel/Tokens/Protocols.sol (line 3):

    `pragma solidity 0.8.13;`

36. File: 2022-07-swivel/VaultTracker/Compounding.sol (line 3):

    `pragma solidity 0.8.13;`

37. File: 2022-07-swivel/VaultTracker/FixedPointMathLib.sol (line 2):

    `pragma solidity 0.8.0;`         

38. File: 2022-07-swivel/VaultTracker/Interfaces.sol (line 3):

    `pragma solidity 0.8.13;`

39. File: 2022-07-swivel/VaultTracker/LibCompound.sol (line 2):

    `pragma solidity 0.8.4;` 

40. File: 2022-07-swivel/VaultTracker/LibFuse.sol (line 1):

    `pragma solidity 0.8.13;`         

41. File: 2022-07-swivel/VaultTracker/Protocols.sol (line 3):

    `pragma solidity 0.8.14;`

42. File: 2022-07-swivel/VaultTracker/VaultTracker.sol (line 3):

    `pragma solidity 0.8.13;`

[G-07] Multiple address mappings can be combined into a single mapping of an address to a struct, where appropriate (Saves a storage slot for the mapping. Depending on the circumstances and sizes of types, can avoid a Gsset (20000 gas) per mapping combined. Reads and subsequent writes can also be cheaper when a function requires both values and they both fit in the same storage slot):-

1. File: 2022-07-swivel/Creator/Erc20.sol (line 35-37):

    ` mapping(address => uint256) public balanceOf;

mapping(address => mapping(address => uint256)) public allowance;`

2. File: 2022-07-swivel/Marketplace/Erc20.sol (line 35-37):

    `  mapping(address => uint256) public balanceOf;

mapping(address => mapping(address => uint256)) public allowance;`

3. File: 2022-07-swivel/Tokens/Erc20.sol (line 35-37):

    `    mapping(address => uint256) public balanceOf;

mapping(address => mapping(address => uint256)) public allowance;`

AuditHub

A portfolio for auditors, a security profile for protocols, a hub for web3 security.

Built bymalatrax © 2024

Auditors

Browse

Contests

Browse

Get in touch

ContactTwitter