Fei Protocol contest - Meta0xNull's results

Handle

Meta0xNull

Vulnerability details

Impact

In FEI RARI Merger Draft: VIII. Ragequit C. Intrinsic Value (IV) is defined as Protocol Equity (PCV - User Circulating Fei) divided by the Pre-merger TRIBE Circulating Supply. The Protocol Equity number is taken from Fei’s Collaterization Oracle and updated on each ragequit such that Protocol Equity can only be lowered.

The Ragequit function ngmi() here Does Not Call requery() to Update Protocol Equity Number, minProtocolEquity.

By right requery() will Obtain Oracle Data and then Call recalculate() to Calculate token1OutBase That Used in function ngmi(). It should Be Lower and Lower Everytime Protocol Equity Number is Updated. Meaning those TRIBE Holders who are late to Ragequit will receive less FEI.

But now Some TRIBE Holders may get FEI More than they deserve and FEI Holders will be in Disadvantage because of Over Mint.

Proof of Concept

https://gfxlabs.io/docs/draft_fei_rari_merger.pdf https://github.com/code-423n4/2021-11-fei/blob/main/contracts/TRIBERagequit.sol#L59-L81 https://github.com/code-423n4/2021-11-fei/blob/main/contracts/TRIBERagequit.sol#L110-L130 https://github.com/code-423n4/2021-11-fei/blob/main/contracts/TRIBERagequit.sol#L96-L105

Tools Used

Manual Review

Recommended Mitigation Steps

Add requery() into function ngmi() to Update minProtocolEquity and token1OutBase Everytime.

Handle

Meta0xNull

Vulnerability details

Impact

<code> require(minProtocolEquity > 0, "no equity"); </code> In function ngmi(), it require minProtocolEquity more than 0. But looking at Simulations, requery() is not called to Update minProtocolEquity and thus it always use default value which is 0.

requery() Can be Called by Public But Admin can't Expect All Community Members know how to Read the Contract Code and Call the Function.

Note: This is Different from Another High Risk Report. This Report is Focus On Initial Value, another Report is Focus On Ongoing Value.

Proof of Concept

https://github.com/code-423n4/2021-11-fei/blob/main/contracts/TRIBERagequit.sol#L66 https://github.com/code-423n4/2021-11-fei/blob/main/README.md#simulations https://github.com/code-423n4/2021-11-fei/blob/main/contracts/TRIBERagequit.sol#L110-L130

Tools Used

Manual Review

Recommended Mitigation Steps

In Simulations, Add Extra Step to Call requery() to Update minProtocolEquity.

Handle

Meta0xNull

Vulnerability details

Impact

Shortening revert strings to fit in 32 bytes will decrease deployment time gas and will decrease runtime gas when the revert condition has been met.

Revert strings that are longer than 32 bytes require at least one additional mstore, along with additional overhead for computing memory offset, etc.

Proof of Concept

https://github.com/code-423n4/2021-11-fei/blob/main/contracts/TRIBERagequit.sol#L207 https://github.com/code-423n4/2021-11-fei/blob/main/contracts/TRIBERagequit.sol#L219 https://github.com/code-423n4/2021-11-fei/blob/main/contracts/PegExchanger.sol#L83 https://github.com/code-423n4/2021-11-fei/blob/main/contracts/PegExchanger.sol#L92 https://github.com/code-423n4/2021-11-fei/blob/main/contracts/PegExchanger.sol#L104 https://github.com/code-423n4/2021-11-fei/blob/main/contracts/PegExchanger.sol#L112

Tools Used

Manual Review

Recommended Mitigation Steps

Shorten the revert strings to fit in 32 bytes.

Or consider using Custom Errors (solc >=0.8.4).

Handle

Meta0xNull

Vulnerability details

Impact

The local variable used as for loop index need not be initialized to 0 because the default value is 0. Avoiding this anti-pattern can save a few opcodes and therefore a tiny bit of gas.

Proof of Concept

https://github.com/code-423n4/2021-11-fei/blob/main/contracts/TRIBERagequit.sol#L165

Tools Used

Manual Review

Recommended Mitigation Steps

Remove explicit 0 initialization of for loop index variable.

Before: for (uint256 i = 0; After for (uint256 i;

Handle

Meta0xNull

Vulnerability details

Impact

Every Computation On Chain Cost Gas.

Proof of Concept

https://github.com/code-423n4/2021-11-fei/blob/main/contracts/PegExchanger.sol#L17 https://github.com/code-423n4/2021-11-fei/blob/main/contracts/PegExchanger.sol#L107

Tools Used

Manual Review

Recommended Mitigation Steps

Before: uint256 public constant MIN_EXPIRY_WINDOW = 6400 * 365;

After: uint256 public constant MIN_EXPIRY_WINDOW = 2336000;