Platform: Code4rena
Start Date: 21/11/2022
Pot Size: $90,500 USDC
Total HM: 18
Participants: 101
Period: 7 days
Judge: Picodes
Total Solo HM: 4
Id: 183
League: ETH
Rank: 92/101
Findings: 1
Award: $39.65
🌟 Selected for report: 0
🚀 Solo Findings: 0
🌟 Selected for report: gzeon
Also found by: 0xPanda, 0xSmartContract, B2, Deivitto, Diana, JohnSmith, PaludoX0, Rahoz, RaymondFam, ReyAdmirado, Rolezn, Schlagatron, Secureverse, Tomio, __141345__, adriro, ajtra, aphak5010, c3phas, chaduke, codeislight, cryptonue, datapunk, dharma09, halden, karanctf, keccak123, oyc_109, pavankv, sakshamguruji, saneryee, unforgiven
39.6537 USDC - $39.65
Because fees[f] never greater than FEE_MAX, it will make feeAmount always lower than assets. We can add unchecked for postFeeAmount to save gas here
When update user rewards accrual state via PirexRewards.userAccrue, UserState was load from storage and it calculate rewards with read 3 time to storage
We should create it as memory to save 2 SLOAD
UserState storage u to UserState memory u
When user call AutoPxGlp.depositFsGlp / AutoPxGlp.depositGlp it will approve for PirexGmx before proceed with the deposit
Since there is a contract, we should consider to approve type(uint256).max in constructor, so eachtime call deposit, it dont need to approve again and again
https://github.com/code-423n4/2022-11-redactedcartel/blob/03b71a8d395c02324cb9fdaf92401357da5b19d1/src/vaults/AutoPxGlp.sol#L347 https://github.com/code-423n4/2022-11-redactedcartel/blob/03b71a8d395c02324cb9fdaf92401357da5b19d1/src/vaults/AutoPxGlp.sol#L391
When user call AutoPxGlp.depositFsGlp it will take stakedGlp from sender and transfer to AutoPxGlp,
then it approve for PirexGmx before transfer token again from AutoPxGlp to PirexGmx
We should consider to just transfer one time from sender directly to PirexGmx
#0 - c4-judge
2022-12-05T14:29:11Z
Picodes marked the issue as grade-b
#1 - drahrealm
2022-12-09T05:42:41Z
With the latest changes to the codebase (not reflected in the frozen codebase for audit here), some of the tips here are no longer beneficial, while others are considered minor relative to the added code complexity (aside from the fact that the target chains of the protocol is Arbitrum and Avalanche)
#2 - c4-sponsor
2022-12-09T05:42:46Z
drahrealm marked the issue as sponsor disputed