Volt Protocol contest - Hawkeye's results

1.Buffer won't be adjusted properly therefore buffer stored will be larger or smaller than expected :

https://github.com/code-423n4/2022-03-volt/blob/f1210bf3151095e4d371c9e9d7682d9031860bbd/contracts/peg/NonCustodialPSM.sol#L232

We calculate the buffer stored :

https://github.com/code-423n4/2022-03-volt/blob/f1210bf3151095e4d371c9e9d7682d9031860bbd/contracts/utils/RateLimited.sol#L106

in buffer() and the value that is stored comes from the minimum of two values :

https://github.com/code-423n4/2022-03-volt/blob/f1210bf3151095e4d371c9e9d7682d9031860bbd/contracts/utils/RateLimited.sol#L85

The issue is with the ‘rateLimitPerSecond’ which is set in the constructor and through setRateLimit() which has limited checks on how the _maxRateLimitPerSecond and the rateLimitPerSecond should be set. If a maximum of zero is set then the rps threshold could not be set to anything above. Or if there was a maximum set, the rps could be set to 0 and would bypass the require check...

With this being said if the first value is used as the minimum of the two values within buffer() with the rps being zero:

bufferStored+(rateLimitPerSecond *elapsed)

would return a lower value than expected.

The opposite effect would occur for _replenishBuffer() as well :

https://github.com/code-423n4/2022-03-volt/blob/f1210bf3151095e4d371c9e9d7682d9031860bbd/contracts/peg/NonCustodialPSM.sol#L300

This issue also affects the GlobalMinter and the amount of individualBuffer for the addresses that are set :

https://github.com/code-423n4/2022-03-volt/blob/f1210bf3151095e4d371c9e9d7682d9031860bbd/contracts/utils/GlobalRateLimitedMinter.sol#L47

this function calls _depleteBuffer() and also individualBuffer() :

https://github.com/code-423n4/2022-03-volt/blob/f1210bf3151095e4d371c9e9d7682d9031860bbd/contracts/utils/MultiRateLimited.sol#L219

https://github.com/code-423n4/2022-03-volt/blob/f1210bf3151095e4d371c9e9d7682d9031860bbd/contracts/utils/GlobalRateLimitedMinter.sol#L61

whose calculation will be incorrect if a zero value is used for the rps..

It also has explications for getMaxMintOut() in PSM.sol as the value returned would be incorrectly calculated based on the arguments put forward above.

Within the constructor in rateLimited.sol,

within require, add && maxRateLimitPerSecond≠0 && rateLimitPerSecond≠0 and bufferCap≠0.

For the other setters in rateLimited.sol and the other contracts that inherit from it, add to the require, rateLimitPerSecond≠0 and bufferCap≠0

2. Ensure that setMintFee () and setRedeemFee() are >0

https://github.com/code-423n4/2022-03-volt/blob/f1210bf3151095e4d371c9e9d7682d9031860bbd/contracts/peg/NonCustodialPSM.sol#L414

https://github.com/code-423n4/2022-03-volt/blob/f1210bf3151095e4d371c9e9d7682d9031860bbd/contracts/peg/NonCustodialPSM.sol#L427

Use unchecked block to save gas :

https://github.com/code-423n4/2022-03-volt/blob/f1210bf3151095e4d371c9e9d7682d9031860bbd/contracts/utils/RateLimited.sol#L106

[https://github.com/code-423n4/2022-03-volt/blob/f1210bf3151095e4d371c9e9d7682d9031860bbd/contracts/utils/MultiRateLimited.sol#L341]

The require check prior to the aforementioned line would ensure that it doesn't underflow..