Ondo Finance - Lalanda's results

Institutional-Grade Finance. On-Chain. For Everyone.

General Information

Platform: Code4rena

Start Date: 01/09/2023

Pot Size: $36,500 USDC

Total HM: 4

Participants: 70

Period: 6 days

Judge: kirk-baird

Id: 281

League: ETH

Ondo Finance

Findings Distribution

Researcher Performance

Rank: 70/70

Findings: 1

Award: $7.08

QA:
grade-b

🌟 Selected for report: 0

🚀 Solo Findings: 0

Awards

7.08 USDC - $7.08

Labels

bug
grade-b
QA (Quality Assurance)
sufficient quality report
Q-14

External Links

TransferShares event emit is not coherent on the field sharesValue

TransferShares event on some instances emits the number of shares, static number with precision 1e18 * 10_000, while on another instances emits the rebasing value of the shares, the balance of the rebasing token, with precision 1e18.

The name of the field, "sharesValue", seems to indicate that the rUSDY rebasing value is to be sent, instead of the term "sharesAmount" used in other parts of the code, to refer to number of shares.

On the function TransferShares the number of shares is sent On the function wrap it is sent the shares usdy value On the internal function _transfer, used on the function transfer and transferFrom, again the number of shares is sent

rUSDYFactory event rUSDYDeployed sends a different name than the deployed rUSDY contract

rUSDYFactory event rUSDYDeployed sends on the name field "Ondo Rebasing U.S. Dollar Yield"; while on the deployed rUSDY contract the hardcoded name() function returns "Rebasing Ondo U.S. Dollar Yield".

https://github.com/code-423n4/2023-09-ondo/blob/main/contracts/usdy/rUSDYFactory.sol#L105 https://github.com/code-423n4/2023-09-ondo/blob/main/contracts/usdy/rUSDY.sol#L194-L196

DestinationBridge._mintIfThresholdMet function is internal but its located on the Public Functions section of the file

https://github.com/code-423n4/2023-09-ondo/blob/main/contracts/bridge/DestinationBridge.sol#L327-L353

#0 - c4-pre-sort

2023-09-08T08:27:34Z

raymondfam marked the issue as sufficient quality report

#1 - c4-judge

2023-09-21T10:29:32Z

kirk-baird marked the issue as grade-c

#2 - c4-judge

2023-09-21T10:29:43Z

kirk-baird marked the issue as grade-b

AuditHub

A portfolio for auditors, a security profile for protocols, a hub for web3 security.

Built bymalatrax © 2024

Auditors

Browse

Contests

Browse

Get in touch

ContactTwitter