Platform: Code4rena
Start Date: 30/11/2021
Pot Size: $100,000 USDC
Total HM: 15
Participants: 36
Period: 7 days
Judge: 0xean
Total Solo HM: 4
Id: 62
League: ETH
Rank: 17/36
Findings: 3
Award: $2,071.24
🌟 Selected for report: 3
🚀 Solo Findings: 0
🌟 Selected for report: cmichel
Also found by: GeekyLumberjack, hyh, kenzo, pedroais
1057.3907 USDC - $1,057.39
GeekyLumberjack
passing rewardToken into recoverTokens() will fail if called after claimRewards()
this test function can be added to Locke.t.sol to easily show this problem.
https://github.com/GeekyLumberjack/ProofOfConcept-stream-1/blob/main/proof.sol
dapp tools
update rewardTokenAmount in claimRewards()
#0 - brockelmore
2021-12-03T21:40:36Z
Nice catch & thank you for the proof of concept!
However the issue is not rewardTokenAmount being updated, that should be a high water mark for rewardTokenAmount. We should use a claimedRewards accumulator and subtract that out from the recover token like we do for depositTokens.
#1 - brockelmore
2022-01-05T16:55:04Z
duplicate #214
🌟 Selected for report: GeekyLumberjack
GeekyLumberjack
This may lead someone to believe the function works differently than it does.
//@audit inaccurate comment, this function will claim fees in rewards and in deposit tokens /** * @dev Allows the governance contract of the factory to select a destination * and transfer fees (in rewardTokens) to that address totaling the total fee amount */
Update comment to include a note about deposit fees being claimed in this function
GeekyLumberjack
gas cost
change this line in flashloan()
//@audit why not just divide by 1000 instead of multiply by 10 and then divide by 10000 uint112 feeAmt = amount * 10 / 10000; // 10bps fee
to
uint112 feeAmt = amount / 1000; // 10bps fee
#0 - 0xean
2022-01-18T13:51:32Z
dupe of #188
🌟 Selected for report: GeekyLumberjack
GeekyLumberjack
increase gas cost
replace
//@audit multiplying by 1 million just to divide by 1 million is unnecessary. Remove this to save gas. return ((uint256(streamDuration) * amount * 10**6) / timeRemaining) / 10**6;
with
return (uint256(streamDuration) * amount ) / timeRemaining) ;
🌟 Selected for report: GeekyLumberjack
GeekyLumberjack
gas cost
replace creatorClaimSoldTokens() with:
`` function creatorClaimSoldTokens(address destination) public lock { // can only claim when its a sale require(isSale, "!sale");
// only can claim once require(!claimedDepositTokens, "claimed"); // creator is claiming require(msg.sender == streamCreator, "!creator"); // stream ended require(block.timestamp >= endStream, "stream"); claimedDepositTokens = true; ERC20(depositToken).safeTransfer(destination, depositTokenAmount); emit SoldTokensClaimed(destination, depositTokenAmount); }
``