Platform: Code4rena
Start Date: 14/04/2022
Pot Size: $75,000 USDC
Total HM: 8
Participants: 72
Period: 7 days
Judge: Jack the Pug
Total Solo HM: 2
Id: 110
League: ETH
Rank: 63/72
Findings: 1
Award: $89.30
🌟 Selected for report: 0
🚀 Solo Findings: 0
🌟 Selected for report: Dravee
Also found by: 0v3rf10w, 0x1f8b, 0xAsm0d3us, 0xBug, 0xDjango, 0xNazgul, 0xkatana, CertoraInc, Cityscape, Funen, Hawkeye, IllIllI, MaratCerby, SolidityScan, TerrierLover, TomFrenchBlockchain, Tomio, TrungOre, bae11, berndartmueller, csanuragjain, defsec, delfin454000, ellahi, fatherOfBlocks, gs8nrv, gzeon, horsefacts, ilan, jah, joestakey, joshie, kebabsec, kenta, nahnah, oyc_109, rayn, rfa, robee, saian, securerodd, simon135, slywaters, sorrynotsorry, tchkvsky, teryanarmen, z3s
89.3011 USDC - $89.30
Proof of Concept: https://github.com/code-423n4/2022-04-badger-citadel/blob/main/src/CitadelMinter.sol#L152
Recommended Mitigation Steps: change to prefix increment and unchecked
========================================================================
+=
to increase value on varProof of Concept: https://github.com/code-423n4/2022-04-badger-citadel/blob/main/src/CitadelMinter.sol#L279 https://github.com/code-423n4/2022-04-badger-citadel/blob/main/src/KnightingRound.sol#L196-L199
Recommended Mitigation Steps: Change to:
_newTotalWeight += _weight;
========================================================================
!=
instead of >
is more gas efficientProof of Concept: https://github.com/code-423n4/2022-04-badger-citadel/blob/main/src/CitadelMinter.sol#L343 https://github.com/code-423n4/2022-04-badger-citadel/blob/main/src/Funding.sol#L170 https://github.com/code-423n4/2022-04-badger-citadel/blob/main/src/Funding.sol#L452
Recommended Mitigation Steps: Change to:
require(length != 0, "CitadelMinter: no funding pools");
========================================================================
Proof of Concept: https://github.com/code-423n4/2022-04-badger-citadel/blob/main/src/CitadelMinter.sol#L152 https://github.com/code-423n4/2022-04-badger-citadel/blob/main/src/CitadelMinter.sol#L180-L182 https://github.com/code-423n4/2022-04-badger-citadel/blob/main/src/SupplySchedule.sol#L192
Recommended Mitigation Steps: remove 0
========================================================================
Proof of Concept: https://github.com/code-423n4/2022-04-badger-citadel/blob/main/src/CitadelMinter.sol#L366 https://github.com/code-423n4/2022-04-badger-citadel/blob/main/src/StakedCitadel.sol#L416
Recommended Mitigation Steps: Change to:
delete fundingPoolWeights[_pool];
========================================================================
Proof of Concept: https://github.com/code-423n4/2022-04-badger-citadel/blob/main/src/Funding.sol#L236 https://github.com/code-423n4/2022-04-badger-citadel/blob/main/src/KnightingRound.sol#L250
Recommended Mitigation Steps:
Unchecked{ limitLeft_ = assetCap - assetCumulativeFunded; }
========================================================================
>
is cheaper than >=
Proof of Concept: https://github.com/code-423n4/2022-04-badger-citadel/blob/main/src/Funding.sol#L270-L271 https://github.com/code-423n4/2022-04-badger-citadel/blob/main/src/Funding.sol#L361
Recommended Mitigation Steps:
1 second difference can be ignored to validate
Change from:
>=
or <=
to:
>
or <
========================================================================
calldata
to store struct data type can save gasProof of Concept: https://github.com/code-423n4/2022-04-badger-citadel/blob/main/src/Funding.sol#L244
Recommended Mitigation Steps:
Change memory
to calldata
========================================================================
Proof of Concept: https://github.com/code-423n4/2022-04-badger-citadel/blob/main/src/StakedCitadel.sol#L859
Recommended Mitigation Steps:
declare governancePerformanceFee, strategistPerformanceFee in function returns
and delete #L874 can save gas
function _calculatePerformanceFee(uint256 _amount) internal view returns (uint256 governancePerformanceFee, uint256 strategistPerformanceFee) //@audit-info return here { uint256 governancePerformanceFee = _calculateFee( _amount, performanceFeeGovernance ); uint256 strategistPerformanceFee = _calculateFee( _amount, performanceFeeStrategist ); }
========================================================================
citadelAmountWithoutDiscount
MSTOREProof of Concept: https://github.com/code-423n4/2022-04-badger-citadel/blob/main/src/Funding.sol#L207
Recommended Mitigation Steps:
citadelAmountWithoutDiscount
only called once. just calculated directly to citadelAmount_
#L211
if (funding.discount > 0) { citadelAmount_ = ((_assetAmountIn * citadelPriceInAsset)* MAX_BPS) / (MAX_BPS - funding.discount); }
========================================================================