Platform: Code4rena
Start Date: 07/04/2022
Pot Size: $100,000 USDC
Total HM: 20
Participants: 62
Period: 7 days
Judge: LSDan
Total Solo HM: 11
Id: 107
League: ETH
Rank: 34/62
Findings: 2
Award: $236.63
🌟 Selected for report: 0
🚀 Solo Findings: 0
🌟 Selected for report: Dravee
Also found by: 0x1f8b, 0xDjango, 0xkatana, AuditsAreUS, Cityscape, Foundation, Funen, Hawkeye, IllIllI, JC, JMukesh, Jujic, Kthere, PPrieditis, Picodes, Ruhum, TerrierLover, TrungOre, WatchPug, berndartmueller, catchup, cccz, cmichel, delfin454000, dy, ellahi, hickuphh3, horsefacts, hubble, hyh, ilan, jayjonah8, kebabsec, kenta, minhquanym, pauliax, rayn, reassor, rfa, robee, samruna
155.9803 USDC - $155.98
1.Incorrect spelling
In FungibleAssetVaultForDAO.sol, withdraw () uses the transfer function to send funds when the collateralAsset is Eth. But, this is not recommended especially if the call is made by a smart contract as its fallback will consume more than the 2300 gas stipend:
A similar finding was made for Open Leverage in this report :
https://github.com/code-423n4/2022-01-openleverage-findings/issues/75
When mentioned, #sphagetti dev stated :
‘in our case it still works since gnosis safes consume less than 2300 gas when receiving eth since the receive function is empty’.
🌟 Selected for report: Dravee
Also found by: 0v3rf10w, 0x1f8b, 0xDjango, 0xNazgul, 0xkatana, Cityscape, Cr4ckM3, FSchmoede, Foundation, Funen, Hawkeye, IllIllI, JMukesh, Meta0xNull, PPrieditis, Picodes, TerrierLover, Tomio, WatchPug, berndartmueller, catchup, delfin454000, dirk_y, ellahi, hickuphh3, ilan, kebabsec, kenta, nahnah, rayn, rfa, robee, rokinot, saian, securerodd, slywaters, sorrynotsorry
80.65 USDC - $80.65
1.Use unchecked block for code below :
Since the debtAmount including interest should be greater that the debtPrincipal, the calculation shouldn't revert:
The checks prior ensures that there's no underflow :
With refactored code for gas savings :
if(amount>debtAmount) {
amount=debtAmount;
debtAmount-=amount;
} else {
unchecked {
amount=amount ;
debtAmount-=amount;
}
}