Platform: Code4rena
Start Date: 13/05/2022
Pot Size: $30,000 USDC
Total HM: 8
Participants: 65
Period: 3 days
Judge: hickuphh3
Total Solo HM: 1
Id: 125
League: ETH
Rank: 31/65
Findings: 3
Award: $83.10
🌟 Selected for report: 0
🚀 Solo Findings: 0
🌟 Selected for report: pedroais
Also found by: 0x4non, 0x52, 0xf15ers, 0xliumin, CertoraInc, Dravee, GimelSec, IllIllI, MaratCerby, StErMi, TerrierLover, WatchPug, berndartmueller, cccz, dipp, fatherOfBlocks, hake, hickuphh3, hyh, isamjay, mtz, oyc_109, p4st13r4, peritoflores, rotcivegaf, saian, simon135, sorrynotsorry, sseefried, tabish, z3s
14.8433 USDC - $14.84
https://github.com/code-423n4/2022-05-sturdy/blob/main/smart-contracts/LidoVault.sol#L140-L142
It should check require before return, but _withdrawFromYieldPool function just return before require, resulting in not checking the result of the call, users may lose their collateral.
The _withdrawFromYieldPool function in LidoVault.sol:
(bool sent, bytes memory data) = address(_to).call{value: receivedETHAmount}(''); return receivedETHAmount; require(sent, Errors.VT_COLLATERAL_WITHDRAW_INVALID);
vim
(bool sent, bytes memory data) = address(_to).call{value: receivedETHAmount}(''); require(sent, Errors.VT_COLLATERAL_WITHDRAW_INVALID); return receivedETHAmount;
#0 - sforman2000
2022-05-18T03:10:45Z
🌟 Selected for report: IllIllI
Also found by: 0x1f8b, 0x4non, 0xNazgul, 0xf15ers, 0xkatana, 0xliumin, AlleyCat, BouSalman, Dravee, Funen, GimelSec, Hawkeye, MaratCerby, Picodes, StErMi, TerrierLover, WatchPug, Waze, berndartmueller, bobirichman, cryptphi, csanuragjain, defsec, delfin454000, dipp, fatherOfBlocks, hake, hickuphh3, hyh, joestakey, kebabsec, mics, mtz, oyc_109, p4st13r4, p_crypt0, robee, rotcivegaf, sikorico, simon135, sorrynotsorry, tintin
44.7969 USDC - $44.80
We list 2 low-critical findings and 1 non-critical findings:
GeneralVault\initialize() should check the address of _provider != address(0)setConfiguration should check the address of _lpToken != address(0)YieldManager.sol setter functionsGeneralVault\initialize() should check the address of _provider != address(0)In GeneralVault.sol, initialize() should check the address of _provider != address(0)
https://github.com/code-423n4/2022-05-sturdy/blob/main/smart-contracts/GeneralVault.sol#L61-L63
vim
Check address(_provider) != address(0).
setConfiguration should check the address of _lpToken != address(0)In ConvexCurveLPVault.sol, setConfiguration should check the address of _lpToken != address(0)
vim
Check address(_lpToken) != address(0).
YieldManager.sol setter functionsIt’s better to have events in setter functions.
https://github.com/code-423n4/2022-05-sturdy/blob/main/smart-contracts/YieldManager.sol#L92
https://github.com/code-423n4/2022-05-sturdy/blob/main/smart-contracts/YieldManager.sol#L64
vim
Add events for setter functions.
#0 - HickupHH3
2022-06-06T06:17:22Z
Both are NC.
🌟 Selected for report: IllIllI
Also found by: 0v3rf10w, 0x1f8b, 0x4non, 0xNazgul, 0xf15ers, 0xkatana, 0xliumin, Cityscape, Dravee, Fitraldys, Funen, GimelSec, Hawkeye, JC, MaratCerby, SooYa, StErMi, Tomio, WatchPug, Waze, bobirichman, defsec, delfin454000, fatherOfBlocks, hake, hansfriese, hickuphh3, ignacio, joestakey, kebabsec, mics, mtz, oyc_109, robee, rotcivegaf, samruna, sikorico, simon135, z3s
23.4569 USDC - $23.46
++i rather than i++In for loops, using ++i rather than i++ to save gas.
GeneralVault.sol 218: for (uint256 i = 0; i < length; i++) { ConvexCurveLPVault.sol 106: for (uint256 i = 0; i < extraRewardsLength; i++) { YieldManager.sol 120: for (uint256 i = 0; i < _count; i++) { 130: for (uint256 i = 0; i < assetYields.length; i++) { 156: for (uint256 i = 0; i < length; i++) {
Use ++i rather than i++ to save gas.
https://github.com/code-423n4/2022-05-sturdy/blob/main/smart-contracts/ConvexCurveLPVault.sol#L40
address public constant convexBooster = 0xF403C135812408BFbE8713b5A23a04b3D48AAE31;