Sturdy contest - Hawkeye's results

The first protocol for interest-free borrowing and high yield lending.

General Information

Platform: Code4rena

Start Date: 13/05/2022

Pot Size: $30,000 USDC

Total HM: 8

Participants: 65

Period: 3 days

Judge: hickuphh3

Total Solo HM: 1

Id: 125

League: ETH

Sturdy

Findings Distribution

Researcher Performance

Rank: 34/65

Findings: 2

Award: $69.38

๐ŸŒŸ Selected for report: 0

๐Ÿš€ Solo Findings: 0

QA

I. Declared variables are already their defaults, no need to assign.

ConvexCurveLPVault.sol

https://github.com/code-423n4/2022-05-sturdy/blob/78f51a7a74ebe8adfd055bdbaedfddc05632566f/smart-contracts/ConvexCurveLPVault.sol#L106

GeneralVault.sol

https://github.com/code-423n4/2022-05-sturdy/blob/78f51a7a74ebe8adfd055bdbaedfddc05632566f/smart-contracts/GeneralVault.sol#L218

YieldManager.sol

https://github.com/code-423n4/2022-05-sturdy/blob/78f51a7a74ebe8adfd055bdbaedfddc05632566f/smart-contracts/YieldManager.sol#L120

https://github.com/code-423n4/2022-05-sturdy/blob/78f51a7a74ebe8adfd055bdbaedfddc05632566f/smart-contracts/YieldManager.sol#L130

https://github.com/code-423n4/2022-05-sturdy/blob/78f51a7a74ebe8adfd055bdbaedfddc05632566f/smart-contracts/YieldManager.sol#L156

II.Check that the same asset is not added more than once:

https://github.com/code-423n4/2022-05-sturdy/blob/78f51a7a74ebe8adfd055bdbaedfddc05632566f/smart-contracts/YieldManager.sol#L73

III. Ensure that there is adequate balance before calling the function mentioned :

https://github.com/code-423n4/2022-05-sturdy/blob/78f51a7a74ebe8adfd055bdbaedfddc05632566f/smart-contracts/YieldManager.sol#L124

add, if (amountโ‰ 0) {

convertAssetToExchangeToken() ;

}

IV. The interface provided is not in scope but it makes a call from processYield()

https://github.com/sturdyfi/code4rena-may-2022/blob/d53f4f5f0b7b33a66e0081294be6117f6d6e17b4/contracts/interfaces/IConvexBaseRewardPool.sol#L11

https://github.com/code-423n4/2022-05-sturdy/blob/78f51a7a74ebe8adfd055bdbaedfddc05632566f/smart-contracts/ConvexCurveLPVault.sol#L90

The above interface doesn't return anything but Convex's base Reward Pool returns a Boolean on a successful withdrawal of rewards:

https://github.com/convex-eth/platform/blob/1f11027d429e454dacc4c959502687eaeffdb74a/contracts/contracts/BaseRewardPool.sol#L281

#0 - HickupHH3

2022-06-06T09:08:14Z

Low: II, III NC: I, IV

Awards

23.4569 USDC - $23.46

Labels

bug
G (Gas Optimization)

External Links

Gas

since extraYieldAmount is already initialised

https://github.com/code-423n4/2022-05-sturdy/blob/78f51a7a74ebe8adfd055bdbaedfddc05632566f/smart-contracts/YieldManager.sol#L154

On L160, replace _totalYield Amount with the local variable mentioned above.

AuditHub

A portfolio for auditors, a security profile for protocols, a hub for web3 security.

Built bymalatrax ยฉ 2024

Auditors

Browse

Contests

Browse

Get in touch

ContactTwitter