QuickSwap and StellaSwap contest - Migue's results

A concentrated liquidity DEX with dynamic fees.

General Information

Platform: Code4rena

Start Date: 26/09/2022

Pot Size: $50,000 USDC

Total HM: 13

Participants: 113

Period: 5 days

Judge: 0xean

Total Solo HM: 6

Id: 166

League: ETH

QuickSwap and StellaSwap

Findings Distribution

Researcher Performance

Rank: 71/113

Findings: 1

Award: $52.04

🌟 Selected for report: 0

🚀 Solo Findings: 0

There are several require() sentences without message that explain revert's root cause.

One I would like to point is at DataStorageOperator contract: ``

function changeFeeConfiguration(AdaptiveFee.Configuration calldata _feeConfig) external override { require(msg.sender == factory || msg.sender == IAlgebraFactory(factory).owner()); (....) }

`` I consider this relevant because it is an external call and I didn't get any explanation in the documentation that caller must be the factory.

You can find others similar in AlgebraFactory contract. The previous suggestion applies to the following methods: setOwner, setFarmingAddress, setVaultAddress.

Consider those validation will cause revert and it is not documented anywhere. So I should read the code to understand what is going on in case a revert.

I understand the responsibility could be split between the caller and the protocol but the protocol should manage it by itself.

AuditHub

A portfolio for auditors, a security profile for protocols, a hub for web3 security.

Built bymalatrax © 2024

Auditors

Browse

Contests

Browse

Get in touch

ContactTwitter