Yieldy contest - Funen's results

1. Title : Comment was not the same as actual code

1.) File : Staking.sol Line.155

        @param _curvePool uint

actual code _curvePool was an address

2.) File : Yieldy.sol Line.180

        @return bool - transfer succeeded

it can be changed into @return true if was successful

3.) File : Yieldy.sol Line.198-L221

        @return true

2. Title : Missmatch reason string code

1.) File : Staking.sol Line.410

// amount must be non zero

        require(_amount > 0, "Must have valid amount"); // changed to "amount can't be zero"

2.) File : Staking.sol Lines.117-118

        // cannot claim 0
        require(_recipient.amount > 0, "Must enter valid amount"); // "recipient can't claim 0"

3. Title : Missmatch Event Emitted code

File : Staking.sol Lines.22-23

    event LogSetWarmUpPeriod(uint256 indexed blockNumber, uint256 period);
    event LogSetCoolDownPeriod(uint256 indexed blockNumber, uint256 period);

and emitted to

https://github.com/code-423n4/2022-06-yieldy/blob/524f3b83522125fb7d4677fa7a7e5ba5a2c0fe67/src/contracts/Staking.sol#L228

https://github.com/code-423n4/2022-06-yieldy/blob/524f3b83522125fb7d4677fa7a7e5ba5a2c0fe67/src/contracts/Staking.sol#L237

             emit LogSetCoolDownPeriod(block.number, _vestingPeriod);

It can be changed by doing this implementation below :

    event LogSetWarmUpPeriod(uint256 indexed blockNumber, uint256 vestingPeriod);
    event LogSetCoolDownPeriod(uint256 indexed blockNumber, uint256 vestingPeriod);

Tool Used

Manual Review

4. Title : Avoid multiple initializations

https://github.com/code-423n4/2022-06-yieldy/blob/524f3b83522125fb7d4677fa7a7e5ba5a2c0fe67/src/contracts/Staking.sol#L38

Make sure though that you do not allow multiple initializations. For just a few parameters, simply add a check for each parameter, For many parameters, add an isInitialized boolean state variable:

contract MyContract {
bool isInitialized = false;

function initialize(
  uint256 _param1,
  uint256 _param2, 
  uint256 _param3,
  address _param4,
  address _param5,
  bytes32 _param6,
  bytes32 _param7
) public {
  require(!isInitialized, 'Contract is already initialized!');
  isInitialized = true;

  param1 = _param1;
  ...
  param7 = _param7;
}
}

Tool Used

Manual Review

1. TItle : Shorter Code for saving gas

POC

https://www.tutorialspoint.com/solidity/solidity_operators.htm

1.) File : Yieldy.sol Line.193

        creditBalances[_to] = creditBalances[_to] + creditAmount;

changed to :

creditBalance[_to] +=  creditAmount;

2.) File : Yieldy.sol Line.217-218

        creditBalances[_from] = creditBalances[_from] - creditAmount;
        creditBalances[_to] = creditBalances[_to] + creditAmount;       

changed to

        creditBalances[_from] -= creditAmount;
        creditBalances[_to] += creditAmount;

3.) File : Yieldy.sol Line.252-255

        creditBalances[_address] = creditBalances[_address] + creditAmount;
        rebasingCredits = rebasingCredits + creditAmount;


        _totalSupply = _totalSupply + _amount;

change to :

        creditBalances[_address] += creditAmount;
        rebasingCredits += creditAmount;


        _totalSupply += _amount;

4.) File : Yieldy.sol Line.288-291

        creditBalances[_address] = creditBalances[_address] - creditAmount;
        rebasingCredits = rebasingCredits - creditAmount;
        _totalSupply = _totalSupply - _amount;

change to :

        creditBalances[_address] -= creditAmount;
        rebasingCredits -= creditAmount;
        _totalSupply -=  _amount;

2. Title : Using Prefix than Postfix for cost less gass

main/src/contracts/Staking.sol#L708            epoch.number++; //++epoch.number;

3. Title : Saving gas by removing = 0

This implementation code can be saving more gas by removing = 0, it because If a variable was not set/initialized, it is assumed to have default value to 0

Tool Used

Manual Review

Mitigation Step

Remove = 0

Occurances

main/src/contracts/Staking.sol#L714                epoch.distribute = 0;
main/src/contracts/Staking.sol#L543                amountLeft = 0;

3. Title : Instead using > used != for saving more gas

1.) File : Staking.sol Line.118

        require(_recipient.amount > 0, "Must enter valid amount");

2.) File : Staking.sol Line.410

        require(_amount > 0, "Must have valid amount");

3.) File : Staking.sol Line.572

        require(_amount > 0, "Invalid amount");