Platform: Code4rena
Start Date: 04/11/2021
Pot Size: $50,000 USDC
Total HM: 20
Participants: 28
Period: 7 days
Judge: 0xean
Total Solo HM: 11
Id: 51
League: ETH
Rank: 6/28
Findings: 3
Award: $3,234.11
🌟 Selected for report: 3
🚀 Solo Findings: 1
🌟 Selected for report: Meta0xNull
2907.6165 USDC - $2,907.62
Meta0xNull
When add investor, addInvestor() does not check how many tokens is available from investors_supply. The total tokens allocated for Investors could more than investors_supply.
Possible Attack Scenario:
Manual Review
#0 - chickenpie347
2021-11-16T14:17:23Z
While this is true, the addInvestor would be a one-time routine at deployment which would precisely send the allocated number of tokens to the contract as per to the allocatations.
🌟 Selected for report: Reigada
Also found by: Meta0xNull
20.1994 USDC - $20.20
Meta0xNull
Repeat Check is just waste of gas
First Check at _claimableAmount(): assert(s <= benTotal[_addr]); https://github.com/code-423n4/2021-11-bootfinance/blob/main/vesting/contracts/Vesting.sol#L186
Second Check at claim(): require(amount <= benTotal[msg.sender], "Cannot withdraw more than total vested amount"); https://github.com/code-423n4/2021-11-bootfinance/blob/main/vesting/contracts/Vesting.sol#L197
Manual Review
Remove Second Check to save some gas
#0 - chickenpie347
2022-01-03T23:54:05Z
Duplicate of #115
🌟 Selected for report: Meta0xNull
12.1196 USDC - $12.12
Meta0xNull
Verify Airdrop Address Holders On Chain by Spending Gas is Unnecessary and probably cost a lot after adding up everyone cost.
At UI Frontend, wallet eg. Metamask allow UI to Verify Address Holders Without Spending Any Gas.
Meta0xNull
In Solidity, uint256 locked = 0 is same as uint256 locked but consume extra gas.
https://github.com/code-423n4/2021-11-bootfinance/blob/main/vesting/contracts/Vesting.sol#L63 https://github.com/code-423n4/2021-11-bootfinance/blob/main/vesting/contracts/Vesting.sol#L64 https://github.com/code-423n4/2021-11-bootfinance/blob/main/vesting/contracts/Vesting.sol#L115 https://github.com/code-423n4/2021-11-bootfinance/blob/main/vesting/contracts/Vesting.sol#L116 https://github.com/code-423n4/2021-11-bootfinance/blob/main/vesting/contracts/Vesting.sol#L163 https://github.com/code-423n4/2021-11-bootfinance/blob/main/vesting/contracts/Vesting.sol#L164 https://github.com/code-423n4/2021-11-bootfinance/blob/main/vesting/contracts/Vesting.sol#L165 More...
Manual Review
Remove = 0 to save some Gas.
#0 - chickenpie347
2022-01-03T23:51:37Z
Duplicate of #5
🌟 Selected for report: Meta0xNull
290.7617 USDC - $290.76
Meta0xNull
revoke() Does Not Check Zero Address for _addr
https://github.com/code-423n4/2021-11-bootfinance/blob/main/vesting/contracts/Vesting.sol#L104-L105
more...
Manual Review
Check _addr for Zero Address