Platform: Code4rena
Start Date: 28/04/2022
Pot Size: $50,000 USDC
Total HM: 7
Participants: 43
Period: 5 days
Judge: gzeon
Total Solo HM: 2
Id: 115
League: ETH
Rank: 12/43
Findings: 3
Award: $903.72
🌟 Selected for report: 0
🚀 Solo Findings: 0
🌟 Selected for report: ych18
Also found by: MaratCerby, defsec, robee
ERC20 standard allows approve function of some contracts to return bool or return nothing. Using safeApprove of SafeERC20.sol is recommended instead.
collateralToken.safeApprove(proxy, collateralToken.balanceOf(address(this)));
#0 - m19
2022-05-10T07:30:59Z
Duplicate of #124
#1 - gzeoneth
2022-06-05T15:19:06Z
🌟 Selected for report: Dravee
Also found by: 0x1f8b, 0x4non, 0x52, 0xDjango, AlleyCat, Funen, GalloDaSballo, GimelSec, Hawkeye, MaratCerby, Picodes, berndartmueller, cccz, defsec, delfin454000, dipp, hyh, ilan, joestakey, kebabsec, luduvigo, pauliax, peritoflores, robee, rotcivegaf, samruna, shenwilly, sikorico, simon135, sorrynotsorry, unforgiven, z3s
89.0354 USDC - $89.04
It is recommended to explicityly specify uint256 type instead of uint type for better readability. Affected code: https://github.com/code-423n4/2022-04-mimo/tree/main/supervaults/contracts/SuperVault.sol#L30
Recommended code: uint256 dexIndex;
uint256 is assigned to zero by default, additional reassignment to zero is unnecessary Affected code: https://github.com/code-423n4/2022-04-mimo/tree/main/core/contracts/inception/InceptionVaultsCore.sol#L218
https://docs.soliditylang.org/en/v0.8.13/control-structures.html#default-value
Recommended code: uint256 insuranceAmount;
uint256 is assigned to zero by default, additional reassignment to zero is unnecessary Affected code: https://github.com/code-423n4/2022-04-mimo/tree/main/core/contracts/libraries/ABDKMath64x64.sol#L387
https://docs.soliditylang.org/en/v0.8.13/control-structures.html#default-value
Recommended code: uint256 resultShift;
int256 is assigned to zero by default, additional reassignment to zero is unnecessary Affected code: https://github.com/code-423n4/2022-04-mimo/tree/main/core/contracts/libraries/ABDKMath64x64.sol#L437
https://docs.soliditylang.org/en/v0.8.13/control-structures.html#default-value
Recommended code: int256 msb;
By default state variables/constants are internal. Internal keyword can be omitted. Affected code: https://github.com/code-423n4/2022-04-mimo/tree/main/core/contracts/inception/InceptionVaultsCore.sol#L23
Recommended code: uint256 constant _MAX_INT = 2**256 - 1;
By default state variables/constants are internal. Internal keyword can be omitted. Affected code: https://github.com/code-423n4/2022-04-mimo/tree/main/core/contracts/liquidityMining/v2/GenericMinerV2.sol#L33
Recommended code: IERC20 immutable _par;
By default state variables/constants are internal. Internal keyword can be omitted. Affected code: https://github.com/code-423n4/2022-04-mimo/tree/main/core/contracts/liquidityMining/v2/GenericMinerV2.sol#L34
Recommended code: IGovernanceAddressProvider immutable _a;
By default state variables/constants are internal. Internal keyword can be omitted. Affected code: https://github.com/code-423n4/2022-04-mimo/tree/main/core/contracts/liquidityMining/v2/GenericMinerV2.sol#L36
Recommended code: BoostConfig _boostConfig;
By default state variables/constants are internal. Internal keyword can be omitted. Affected code: https://github.com/code-423n4/2022-04-mimo/tree/main/core/contracts/liquidityMining/v2/GenericMinerV2.sol#L38
Recommended code: mapping(address => UserInfo) _users;
By default state variables/constants are internal. Internal keyword can be omitted. Affected code: https://github.com/code-423n4/2022-04-mimo/tree/main/core/contracts/liquidityMining/v2/GenericMinerV2.sol#L40
Recommended code: uint256 _totalStake;
By default state variables/constants are internal. Internal keyword can be omitted. Affected code: https://github.com/code-423n4/2022-04-mimo/tree/main/core/contracts/liquidityMining/v2/GenericMinerV2.sol#L41
Recommended code: uint256 _totalStakeWithBoost;
By default state variables/constants are internal. Internal keyword can be omitted. Affected code: https://github.com/code-423n4/2022-04-mimo/tree/main/core/contracts/liquidityMining/v2/GenericMinerV2.sol#L43
Recommended code: uint256 _mimoBalanceTracker;
By default state variables/constants are internal. Internal keyword can be omitted. Affected code: https://github.com/code-423n4/2022-04-mimo/tree/main/core/contracts/liquidityMining/v2/GenericMinerV2.sol#L44
Recommended code: uint256 _accMimoAmountPerShare;
By default state variables/constants are internal. Internal keyword can be omitted. Affected code: https://github.com/code-423n4/2022-04-mimo/tree/main/core/contracts/liquidityMining/v2/GenericMinerV2.sol#L46
Recommended code: uint256 _parBalanceTracker;
By default state variables/constants are internal. Internal keyword can be omitted. Affected code: https://github.com/code-423n4/2022-04-mimo/tree/main/core/contracts/liquidityMining/v2/GenericMinerV2.sol#L47
Recommended code: uint256 _accParAmountPerShare;
By default state variables/constants are internal. Internal keyword can be omitted. Affected code: https://github.com/code-423n4/2022-04-mimo/tree/main/core/contracts/liquidityMining/v2/PARMinerV2.sol#L22
Recommended code: IERC20 _par;
By default state variables/constants are internal. Internal keyword can be omitted. Affected code: https://github.com/code-423n4/2022-04-mimo/tree/main/core/contracts/liquidityMining/v2/PARMinerV2.sol#L23
Recommended code: IGovernanceAddressProvider _a;
By default state variables/constants are internal. Internal keyword can be omitted. Affected code: https://github.com/code-423n4/2022-04-mimo/tree/main/core/contracts/liquidityMining/v2/PARMinerV2.sol#L24
Recommended code: IDexAddressProvider immutable _dexAP;
By default state variables/constants are internal. Internal keyword can be omitted. Affected code: https://github.com/code-423n4/2022-04-mimo/tree/main/core/contracts/liquidityMining/v2/PARMinerV2.sol#L26
Recommended code: BoostConfig _boostConfig;
By default state variables/constants are internal. Internal keyword can be omitted. Affected code: https://github.com/code-423n4/2022-04-mimo/tree/main/core/contracts/liquidityMining/v2/PARMinerV2.sol#L28
Recommended code: mapping(address => UserInfo) _users;
By default state variables/constants are internal. Internal keyword can be omitted. Affected code: https://github.com/code-423n4/2022-04-mimo/tree/main/core/contracts/liquidityMining/v2/PARMinerV2.sol#L30
Recommended code: uint256 _totalStake;
By default state variables/constants are internal. Internal keyword can be omitted. Affected code: https://github.com/code-423n4/2022-04-mimo/tree/main/core/contracts/liquidityMining/v2/PARMinerV2.sol#L31
Recommended code: uint256 _totalStakeWithBoost;
By default state variables/constants are internal. Internal keyword can be omitted. Affected code: https://github.com/code-423n4/2022-04-mimo/tree/main/core/contracts/liquidityMining/v2/PARMinerV2.sol#L32
Recommended code: uint256 _liquidateCallerReward;
By default state variables/constants are internal. Internal keyword can be omitted. Affected code: https://github.com/code-423n4/2022-04-mimo/tree/main/core/contracts/liquidityMining/v2/PARMinerV2.sol#L34
Recommended code: uint256 _mimoBalanceTracker;
By default state variables/constants are internal. Internal keyword can be omitted. Affected code: https://github.com/code-423n4/2022-04-mimo/tree/main/core/contracts/liquidityMining/v2/PARMinerV2.sol#L35
Recommended code: uint256 _accMimoAmountPerShare;
By default state variables/constants are internal. Internal keyword can be omitted. Affected code: https://github.com/code-423n4/2022-04-mimo/tree/main/core/contracts/liquidityMining/v2/PARMinerV2.sol#L37
Recommended code: uint256 _parBalanceTracker;
By default state variables/constants are internal. Internal keyword can be omitted. Affected code: https://github.com/code-423n4/2022-04-mimo/tree/main/core/contracts/liquidityMining/v2/PARMinerV2.sol#L38
Recommended code: uint256 _accParAmountPerShare;
By default state variables/constants are internal. Internal keyword can be omitted. Affected code: https://github.com/code-423n4/2022-04-mimo/tree/main/core/echidna/TIVSetup.sol#L50
Recommended code: MockERC20 _wbtc;
By default state variables/constants are internal. Internal keyword can be omitted. Affected code: https://github.com/code-423n4/2022-04-mimo/tree/main/core/echidna/TIVSetup.sol#L51
Recommended code: MockERC20 _usdc;
By default state variables/constants are internal. Internal keyword can be omitted. Affected code: https://github.com/code-423n4/2022-04-mimo/tree/main/core/echidna/TIVSetup.sol#L52
Recommended code: MockERC20 _link;
By default state variables/constants are internal. Internal keyword can be omitted. Affected code: https://github.com/code-423n4/2022-04-mimo/tree/main/core/echidna/TIVSetup.sol#L53
Recommended code: MockWETH _weth;
By default state variables/constants are internal. Internal keyword can be omitted. Affected code: https://github.com/code-423n4/2022-04-mimo/tree/main/core/echidna/TIVSetup.sol#L54
Recommended code: MockMIMO _mimo;
By default state variables/constants are internal. Internal keyword can be omitted. Affected code: https://github.com/code-423n4/2022-04-mimo/tree/main/core/echidna/TIVSetup.sol#L55
Recommended code: PAR _par;
By default state variables/constants are internal. Internal keyword can be omitted. Affected code: https://github.com/code-423n4/2022-04-mimo/tree/main/core/echidna/TIVSetup.sol#L56
Recommended code: MockInceptionAggregator _wbtcAggregator;
By default state variables/constants are internal. Internal keyword can be omitted. Affected code: https://github.com/code-423n4/2022-04-mimo/tree/main/core/echidna/TIVSetup.sol#L57
Recommended code: MockInceptionAggregator _wethAggregator;
By default state variables/constants are internal. Internal keyword can be omitted. Affected code: https://github.com/code-423n4/2022-04-mimo/tree/main/core/echidna/TIVSetup.sol#L58
Recommended code: MockInceptionAggregator _usdcAggregator;
By default state variables/constants are internal. Internal keyword can be omitted. Affected code: https://github.com/code-423n4/2022-04-mimo/tree/main/core/echidna/TIVSetup.sol#L59
Recommended code: MockInceptionAggregator _eurUsdAggregator;
By default state variables/constants are internal. Internal keyword can be omitted. Affected code: https://github.com/code-423n4/2022-04-mimo/tree/main/core/echidna/TIVSetup.sol#L60
Recommended code: MockInceptionAggregator _linkAggregator;
By default state variables/constants are internal. Internal keyword can be omitted. Affected code: https://github.com/code-423n4/2022-04-mimo/tree/main/core/echidna/TIVSetup.sol#L62
Recommended code: AccessController _accessController;
By default state variables/constants are internal. Internal keyword can be omitted. Affected code: https://github.com/code-423n4/2022-04-mimo/tree/main/core/echidna/TIVSetup.sol#L63
Recommended code: AddressProvider _addressProvider;
By default state variables/constants are internal. Internal keyword can be omitted. Affected code: https://github.com/code-423n4/2022-04-mimo/tree/main/core/echidna/TIVSetup.sol#L64
Recommended code: ConfigProvider _configProvider;
By default state variables/constants are internal. Internal keyword can be omitted. Affected code: https://github.com/code-423n4/2022-04-mimo/tree/main/core/echidna/TIVSetup.sol#L65
Recommended code: PriceFeed _priceFeed;
By default state variables/constants are internal. Internal keyword can be omitted. Affected code: https://github.com/code-423n4/2022-04-mimo/tree/main/core/echidna/TIVSetup.sol#L66
Recommended code: RatesManager _ratesManager;
By default state variables/constants are internal. Internal keyword can be omitted. Affected code: https://github.com/code-423n4/2022-04-mimo/tree/main/core/echidna/TIVSetup.sol#L67
Recommended code: LiquidationManager _liquidationManager;
By default state variables/constants are internal. Internal keyword can be omitted. Affected code: https://github.com/code-423n4/2022-04-mimo/tree/main/core/echidna/TIVSetup.sol#L68
Recommended code: FeeDistributor _feeDistributor;
By default state variables/constants are internal. Internal keyword can be omitted. Affected code: https://github.com/code-423n4/2022-04-mimo/tree/main/core/echidna/TIVSetup.sol#L69
Recommended code: VaultsDataProvider _vaultsDataProvider;
By default state variables/constants are internal. Internal keyword can be omitted. Affected code: https://github.com/code-423n4/2022-04-mimo/tree/main/core/echidna/TIVSetup.sol#L70
Recommended code: VaultsCoreState _vaultsCoreState;
By default state variables/constants are internal. Internal keyword can be omitted. Affected code: https://github.com/code-423n4/2022-04-mimo/tree/main/core/echidna/TIVSetup.sol#L71
Recommended code: VaultsCore _vaultsCore;
By default state variables/constants are internal. Internal keyword can be omitted. Affected code: https://github.com/code-423n4/2022-04-mimo/tree/main/core/echidna/TIVSetup.sol#L72
Recommended code: GovernanceAddressProvider _governanceAddressProvider;
By default state variables/constants are internal. Internal keyword can be omitted. Affected code: https://github.com/code-423n4/2022-04-mimo/tree/main/core/echidna/TIVSetup.sol#L73
Recommended code: DebtNotifier _debtNotifier;
By default state variables/constants are internal. Internal keyword can be omitted. Affected code: https://github.com/code-423n4/2022-04-mimo/tree/main/core/echidna/TIVSetup.sol#L74
Recommended code: SupplyMiner _wbtcSupplyMiner;
By default state variables/constants are internal. Internal keyword can be omitted. Affected code: https://github.com/code-423n4/2022-04-mimo/tree/main/core/echidna/TIVSetup.sol#L75
Recommended code: SupplyMiner _wethSupplyMiner;
By default state variables/constants are internal. Internal keyword can be omitted. Affected code: https://github.com/code-423n4/2022-04-mimo/tree/main/core/echidna/TIVSetup.sol#L76
Recommended code: SupplyMiner _usdcSupplyMiner;
By default state variables/constants are internal. Internal keyword can be omitted. Affected code: https://github.com/code-423n4/2022-04-mimo/tree/main/core/echidna/TIVSetup.sol#L77
Recommended code: InceptionVaultFactory _inceptionVaultFactory;
By default state variables/constants are internal. Internal keyword can be omitted. Affected code: https://github.com/code-423n4/2022-04-mimo/tree/main/core/echidna/TIVSetup.sol#L78
Recommended code: AdminInceptionVault _baseAdminInceptionVault;
By default state variables/constants are internal. Internal keyword can be omitted. Affected code: https://github.com/code-423n4/2022-04-mimo/tree/main/core/echidna/TIVSetup.sol#L79
Recommended code: InceptionVaultsCore _baseInceptionVaultsCore;
By default state variables/constants are internal. Internal keyword can be omitted. Affected code: https://github.com/code-423n4/2022-04-mimo/tree/main/core/echidna/TIVSetup.sol#L80
Recommended code: InceptionVaultsDataProvider _baseInceptionVaultsDataProvider;
By default state variables/constants are internal. Internal keyword can be omitted. Affected code: https://github.com/code-423n4/2022-04-mimo/tree/main/core/echidna/TIVSetup.sol#L81
Recommended code: ChainlinkInceptionPriceFeed _baseChainlinkInceptionPriceFeed;
By default state variables/constants are internal. Internal keyword can be omitted. Affected code: https://github.com/code-423n4/2022-04-mimo/tree/main/core/echidna/TIVSetup.sol#L83
Recommended code: uint256 constant _MAX_INT = 2**256 - 1;
By default state variables/constants are internal. Internal keyword can be omitted. Affected code: https://github.com/code-423n4/2022-04-mimo/tree/main/core/echidna/TIVSetup.sol#L84
Recommended code: address _echidna_caller = 0x00a329c0648769A73afAc7F9381E08FB43dBEA72;
By default state variables/constants are internal. Internal keyword can be omitted. Affected code: https://github.com/code-423n4/2022-04-mimo/tree/main/supervaults/contracts/SuperVault.sol#L36
Recommended code: IDexAddressProvider _dexAP;
Transfer from sender to contract and from contract to inception vault could be replaced in a single transfer. Affected code: https://github.com/code-423n4/2022-04-mimo/blob/b18670f44d595483df2c0f76d1c57a7bfbfbc083/core/contracts/inception/InceptionVaultsCore.sol#L234-L235
Recommended code: stablex.safeTransferFrom(msg.sender, address(_adminInceptionVault), _amount);
#0 - gzeoneth
2022-06-05T16:37:41Z
Warden spammed > 20 submission with very similar finding and multiple QA report. A penalty is applied to the score of this report.
59.0559 USDC - $59.06
There is a global constant type(uint256).max which saves 10 gas comparing to using 2**256 - 1 Affected code: https://github.com/code-423n4/2022-04-mimo/blob/b18670f44d595483df2c0f76d1c57a7bfbfbc083/core/contracts/inception/InceptionVaultsCore.sol#L23
Recommended code: uint256 internal constant _MAX_INT = type(uint256).max;
There is a global constant type(uint256).max which saves 10 gas comparing to using 2**256 - 1 Affected code: https://github.com/code-423n4/2022-04-mimo/blob/b18670f44d595483df2c0f76d1c57a7bfbfbc083/supervaults/contracts/SuperVault.sol#L326
Recommended code: token.approve(address(a.core()), type(uint256).max);
It is recommended to tightly pack structs in order to save gas on SSTORE/SREAD operations. Affected code: https://github.com/code-423n4/2022-04-mimo/blob/b18670f44d595483df2c0f76d1c57a7bfbfbc083/core/contracts/inception/interfaces/IInceptionVaultsDataProvider.sol#L9-L14
Recommended code: struct InceptionVault { address owner; // uses 20 bytes uint96 createdAt; // uses 12 bytes, combining with above uses one 32 bytes slot uint256 collateralBalance; uint256 baseDebt; }
It is recommended to tightly pack structs in order to save gas on SSTORE/SREAD operations. Affected code: https://github.com/code-423n4/2022-04-mimo/blob/b18670f44d595483df2c0f76d1c57a7bfbfbc083/core/contracts/liquidityMining/v2/interfaces/IDemandMinerV2.sol#L17-L20
Recommended code: struct FeeConfig { uint128 depositFee; // 16 bytes uint128 withdrawFee; // 16 bytes, combining with above uses one 32 bytes slot }
It is recommended to tightly pack structs in order to save gas on SSTORE/SREAD operations. Affected code: https://github.com/code-423n4/2022-04-mimo/blob/b18670f44d595483df2c0f76d1c57a7bfbfbc083/core/contracts/liquidityMining/v2/interfaces/IGenericMinerV2.sol#L11-L16
Recommended code: struct UserInfo { uint256 stake; uint256 stakeWithBoost; uint128 accAmountPerShare; // 16 bytes uint128 accParAmountPerShare; // 16 bytes, combining with above uses one 32 bytes slot }
As per 0.8.4 solidity version it supports new custom errors. Custom errors are reducing 38 gas if condition is met and 22 gas otherwise. Also reduces contract size and deployment costs.
Affected code: https://github.com/code-423n4/2022-04-mimo/tree/main/supervaults/contracts/SuperVault.sol#L39
https://blog.soliditylang.org/2021/04/21/custom-errors/
Recommended code: error SV001_RequiresAdminRole(); .. if(!(hasRole(DEFAULT_ADMIN_ROLE, msg.sender))) { revert SV001_RequiresAdminRole(); }
As per 0.8.4 solidity version it supports new custom errors. Custom errors are reducing 38 gas if condition is met and 22 gas otherwise. Also reduces contract size and deployment costs.
Affected code: https://github.com/code-423n4/2022-04-mimo/tree/main/supervaults/contracts/SuperVault.sol#L83
https://blog.soliditylang.org/2021/04/21/custom-errors/
Recommended code: error Error_SV002(); .. if(msg.sender != address(lendingPool)) { revert Error_SV002(); }
As per 0.8.4 solidity version it supports new custom errors. Custom errors are reducing 38 gas if condition is met and 22 gas otherwise. Also reduces contract size and deployment costs.
Affected code: https://github.com/code-423n4/2022-04-mimo/tree/main/supervaults/contracts/SuperVault.sol#L109
https://blog.soliditylang.org/2021/04/21/custom-errors/
Recommended code: error Error_SV101(); .. if(token.balanceOf(address(this)) < flashloanRepayAmount) { revert Error_SV101(); }
As per 0.8.4 solidity version it supports new custom errors. Custom errors are reducing 38 gas if condition is met and 22 gas otherwise. Also reduces contract size and deployment costs.
Affected code: https://github.com/code-423n4/2022-04-mimo/tree/main/supervaults/contracts/SuperVault.sol#L156
https://blog.soliditylang.org/2021/04/21/custom-errors/
Recommended code: error Error_SV101(); .. if(fromCollateral.balanceOf(address(this)) < flashloanRepayAmount) { revert Error_SV101(); }
As per 0.8.4 solidity version it supports new custom errors. Custom errors are reducing 38 gas if condition is met and 22 gas otherwise. Also reduces contract size and deployment costs.
Affected code: https://github.com/code-423n4/2022-04-mimo/tree/main/supervaults/contracts/SuperVault.sol#L207
https://blog.soliditylang.org/2021/04/21/custom-errors/
Recommended code: error Error_SV101(); .. if(vaultCollateral.balanceOf(address(this)) < flashloanRepayAmount) { revert Error_SV101(); }
As per 0.8.4 solidity version it supports new custom errors. Custom errors are reducing 38 gas if condition is met and 22 gas otherwise. Also reduces contract size and deployment costs.
Affected code: https://github.com/code-423n4/2022-04-mimo/tree/main/supervaults/contracts/SuperVault.sol#L344
https://blog.soliditylang.org/2021/04/21/custom-errors/
Recommended code: error Error_SV201(); .. if(!(proxy != address(0) && router != address(0))) { revert Error_SV201(); }