PoolTogether Aave v3 contest - TrungOre's results

A protocol for no loss prize savings on Ethereum.

General Information

Platform: Code4rena

Start Date: 29/04/2022

Pot Size: $22,000 USDC

Total HM: 6

Participants: 40

Period: 3 days

Judge: Justin Goro

Total Solo HM: 2

Id: 114

League: ETH

PoolTogether

Findings Distribution

Researcher Performance

Rank: 33/40

Findings: 1

Award: $29.56

🌟 Selected for report: 0

🚀 Solo Findings: 0

External Links

Code4rena Contest Page Github Contest Repository Github Findings Repository PoolTogether

Findings Information

🌟 Selected for report: IllIllI

Also found by: 0v3rf10w, 0x1f8b, 0x4non, 0xDjango, 0xf15ers, 0xkatana, 242, Dravee, GimelSec, MaratCerby, Tadashi, TrungOre, WatchPug, defsec, fatherOfBlocks, gzeon, hake, horsefacts, joestakey, miguelmtzinf, pauliax, pedroais, peritoflores, rotcivegaf, simon135, slywaters, tabish, throttle, z3s

Awards

29.5594 USDC - $29.56

Labels

bug

G (Gas Optimization)

External Links

Link to GitHub issue

[2022-04-pooltogether] QA report

tags: c4, 2022-04-pooltogether

SafeApprove is deprecated

affected code: https://github.com/pooltogether/aave-v3-yield-source/blob/e63d1b0e396a5bce89f093630c282ca1c6627e44/contracts/AaveV3YieldSource.sol#L183
proof of concept: as in comment, safeApprove() function is now deprecated
recommended mitigation steps: As per OpenZepplin documentation “whenever possible, use safeIncreaseAllowance and safeDecreaseAllowance instead”.

Unnecessary use of SafeMath

affected code: https://github.com/pooltogether/aave-v3-yield-source/blob/e63d1b0e396a5bce89f093630c282ca1c6627e44/contracts/AaveV3YieldSource.sol#L27
proof of concept: Because you use the solidity 0.8.10, you don't need to use safeMath anymore

#0 - PierrickGT
2022-05-03T17:01:01Z

SafeApprove is deprecated

Deprecated but perfectly safe to use if allowance is equal to 0, which is the case here.

Unnecessary use of SafeMath

Duplicate of https://github.com/code-423n4/2022-04-pooltogether-findings/issues/11

#1 - gititGoro
2022-05-14T03:56:00Z

Changing to gas optimization since only the safeMath issue is applicable

#2 - JeeberC4
2022-05-23T16:31:00Z

Changing name to better reflect the judging outcome.

PoolTogether Aave v3 contest - TrungOre's results

A protocol for no loss prize savings on Ethereum.

General Information

Findings Distribution

Researcher Performance

External Links

[G-01] Gas Report - $29.56

Findings Information

Awards

Labels

External Links

[2022-04-pooltogether] QA report

SafeApprove is deprecated

Unnecessary use of SafeMath

#0 - PierrickGT2022-05-03T17:01:01Z

#1 - gititGoro2022-05-14T03:56:00Z

#2 - JeeberC42022-05-23T16:31:00Z

#0 - PierrickGT
2022-05-03T17:01:01Z

#1 - gititGoro
2022-05-14T03:56:00Z

#2 - JeeberC4
2022-05-23T16:31:00Z