Aura Finance contest - PPrieditis's results

Title: Do not use totalSupply() to check if Aura.sol is initialised

Impact

"totalSupply() == 0" should not be used as a check for initialization and is a bad coding practise because totalSupply() can be be reduced by token burning

https://github.com/code-423n4/2022-05-aura/blob/main/contracts/Aura.sol#L67 https://github.com/code-423n4/2022-05-aura/blob/main/contracts/Aura.sol#L92

Recommended Mitigation Steps

Use OZ library.

---

Title: Use consistently capital letters for constants

Impact

All constants should use the same naming convention and should be in capital letters

Recommended Mitigation Steps

Change: Aura.sol constant name from "totalCliffs" to "TOTAL_CLIFFS" https://github.com/code-423n4/2022-05-aura/blob/main/contracts/Aura.sol#L29

AuraLocker.sol constant name from "newRewardRatio" to "NEW_REWARD_RATIO" https://github.com/code-423n4/2022-05-aura/blob/main/contracts/AuraLocker.sol#L73 AuraLocker.sol constant name from "rewardsDuration" to "REWARDS_DURATION" https://github.com/code-423n4/2022-05-aura/blob/main/contracts/AuraLocker.sol#L81 AuraLocker.sol constant name from "lockDuration" to "LOCK_DURATION" https://github.com/code-423n4/2022-05-aura/blob/main/contracts/AuraLocker.sol#L83 AuraLocker.sol constant name from "denominator" to "DENOMINATOR" https://github.com/code-423n4/2022-05-aura/blob/main/contracts/AuraLocker.sol#L107

AuraBalRewardPool.sol constant name from "duration" to "DURATION" https://github.com/code-423n4/2022-05-aura/blob/main/contracts/AuraBalRewardPool.sol#L29

---

Title: Constant and immutable variables should be used accordingly to their purpose

Impact

Constants are variables whose value is known before contract deployment. Immutable variables values are revealed only during contract deployment. Aura.sol immutable variable reductionPerCliff is calculated by using two other constants so it should be also a constant.

Recommended Mitigation Steps

Change variable "reductionPerCliff":

• type from a immutable to a constant
• name from a reductionPerCliff to a REDUCTION_PER_CLIFF https://github.com/code-423n4/2022-05-aura/blob/main/contracts/Aura.sol#L30 https://github.com/code-423n4/2022-05-aura/blob/main/contracts/Aura.sol#L52

---

Title: Wrong initial value for Aura.sol variable minterMinted

Impact

Variables should have the correct value straight after contract deployment in order to reflect the proper state.

Recommended Mitigation Steps

Change minterMinted from type(uint256).max to 0 https://github.com/code-423n4/2022-05-aura/blob/main/contracts/Aura.sol#L33

And remove "minterMinted = 0" from init function https://github.com/code-423n4/2022-05-aura/blob/main/contracts/Aura.sol#L74

---

Title: Aura.sol variable minterMinted should be public

Impact

Aura token totalSupply() and EMISSIONS_MAX_SUPPLY are already public. minterMinted shows additional minted tokens who are not part of inflation period. minterMinted should be public in order to be consistent and transparent.

Recommended Mitigation Steps

Change Aura.sol variable minterMinted from private to public https://github.com/code-423n4/2022-05-aura/blob/main/contracts/Aura.sol#L33

---

Title: AuraLocker.setApprovals() should not be in admin function group

Impact

Admin section functions have a onlyOwner modifier however setApprovals() does not has a such modifier and is in admin function section.

Recommended Mitigation Steps

Move function setApprovals() from ADMIN section to ACTIONS section. https://github.com/code-423n4/2022-05-aura/blob/main/contracts/AuraLocker.sol#L239-L242

---

Title: AuraLocker.sol event Staked logs the same variable twice

Impact

Event should emit only valid data. Event Staked emits the same variable lockAmount twice L295. Event declaration L128 states that there should be two different parameters _paidAmount and _lockedAmount.

Recommended Mitigation Steps

Most likely event declaration should not have a parameter _paidAmount. Please remove unnecessary parameter. https://github.com/code-423n4/2022-05-aura/blob/main/contracts/AuraLocker.sol#L295