XDEFI contest - Tomio's results

Handle

Tomio

Vulnerability details

Impact

owner can call function setLockPeriods even when the owner inputting the destination array length and multiplier array length is different.

Proof of Concept

execution succed when inputting imbalance array length example: input duration: [1,2} input multiplier: [1]

Tools Used

Remix - Ethereum IDE

Recommended Mitigation Steps

Handle

Tomio

Vulnerability details

Impact

in solidity 0.8 there's already default check for underflow and overflow. however this default check cost more gas than using unchecked and required for the calculation of underflow and overflow check.

Proof of Concept

pragma solidity =0.8.10;

contract test {


    function nounchecked(uint amount1, uint amount2)external returns(uint){
        return amount1 - amount2;
        // 22307 gas
    }

    function _unchecked(uint amount1, uint amount2)external returns(uint){

        unchecked{
            require(amount2 <= amount1);
            return amount1 - amount2;
        }
        // 22129 gas
    }
}

Tools Used

Remix - Ethereum IDE

Recommended Mitigation Steps

Handle

Tomio

Vulnerability details

Impact

in function setLockPeriods multiplier can be set to lower than 100 which will break the calculation when dividing the multiplier in function lock https://github.com/XDeFi-tech/xdefi-distribution/blob/master/contracts/XDEFIDistribution.sol#L268. If the amount times bonus multiplier below 100 the units value will be 0, therefore the totalUnits won't be added but the positionOf[tokenId] bill be added.

Proof of Concept

https://github.com/XDeFi-tech/xdefi-distribution/blob/master/contracts/XDEFIDistribution.sol#L77 https://github.com/XDeFi-tech/xdefi-distribution/blob/master/contracts/XDEFIDistribution.sol#L268

Tools Used

Recommended Mitigation Steps

in function setLockPeriods need to be add

        uint256 count = durations_.length;

        for (uint256 i; i < count; ++i) {
            require(multipliers >= 100); //added
            uint256 duration = durations_[i];
            require(duration <= uint256(18250 days), "INVALID_DURATION");
            emit LockPeriodSet(duration, bonusMultiplierOf[duration] = multipliers[i]);
        }
    }