Canto Dex Oracle contest - RaymondFam's results

Execution layer for original work.

General Information

Platform: Code4rena

Start Date: 07/09/2022

Pot Size: $20,000 CANTO

Total HM: 7

Participants: 65

Period: 1 day

Judge: 0xean

Total Solo HM: 3

Id: 159

League: ETH

Canto

Findings Distribution

Researcher Performance

Rank: 58/65

Findings: 1

Award: $39.22

🌟 Selected for report: 0

🚀 Solo Findings: 0

Double Cast of Address

https://github.com/code-423n4/2022-09-canto/blob/main/src/Swap/BaseV1-periphery.sol#L495

The returned type of underlying() is an address. Hence, there is no need to cast it into type address again. The above line code of code could be rewritten as follows:

underlying = ICErc20(address(ctoken)).underlying();

Reserves Should Match to Balances First

https://github.com/code-423n4/2022-09-canto/blob/main/src/Swap/BaseV1-core.sol#L151-L152

The above two lines of codes should be moved to above the first if condition in _update() so that resrve0 and reserve1 are matched to balance0 and balance1 first prior to performing further calculations and/or observations update. Doing this will be more in line with the intended purpose of sync().

AuditHub

A portfolio for auditors, a security profile for protocols, a hub for web3 security.

Built bymalatrax © 2024

Auditors

Browse

Contests

Browse

Get in touch

ContactTwitter