Mimo DeFi contest - GimelSec's results

(Non-Critical) It’s better to use SafeERC20

Impact

It’s better to use the trusted 3rd party library SafeERC20 to check the return value of transfer.

Proof of Concept

liquidityMining/v2/VotingMinerV2.sol
44:      require(_a.mimo().transfer(_user, pendingMIMO), "LM100");
47:      require(_par.transfer(_user, pendingPAR), "LM100");

liquidityMining/v2/GenericMinerV2.sol
220:      require(_a.mimo().transfer(_user, pendingMIMO), "LM100");
223:      require(_par.transfer(_user, pendingPAR), "LM100");

liquidityMining/v2/PARMinerV2.sol
320:      require(_par.transfer(_user, pendingPAR), "LM100");
323:      require(_a.mimo().transfer(_user, pendingMIMO), "LM100");

Tools Used

vim

Recommended Mitigation Steps

Use SafeERC20 rather than checking manually. https://github.com/OpenZeppelin/openzeppelin-contracts/blob/master/contracts/token/ERC20/utils/SafeERC20.sol

Save gas in for loops by ++i rather than i++

In for loops, using ++i rather than i++ to save gas.

Proof of Concept

core/contracts/inception/AdminInceptionVault.sol
108:    for (uint8 i = 1; i < _collateralCount + 1; i++) {

core/contracts/dex/DexAddressProvider.sol
16:    for (uint256 i; i < dexes.length; i++) {

Recommendation

Use ++i rather than i++ to save gas.