Yieldy contest - TrungOre's results

Lines of code

https://github.com/code-423n4/2022-06-yieldy/blob/524f3b83522125fb7d4677fa7a7e5ba5a2c0fe67/src/contracts/Staking.sol#L419-L423

Vulnerability details

Impact

wrong yieldy token to mint

Proof of Concept

There are ERC20 tokens that may make certain customizations to their ERC20 contracts. One type of these tokens is deflationary tokens that charge a certain fee for every transfer() or transferFrom()

Tools Used

Manual review

Recommended Mitigation Steps

get the difference between before and after transfer token

Lines of code

https://github.com/code-423n4/2022-06-yieldy/blob/524f3b83522125fb7d4677fa7a7e5ba5a2c0fe67/src/contracts/Yieldy.sol#L100

Vulnerability details

Impact

wrong information in rebases[] array

Proof of concept

rebase() function should pass the totalStakedBefore (the totalSupply before adding the _profit) to function _storeRebase(), but as in the code rebase() pass the updatedTotalSupply

Tools Used

Manual review

Recommended Mitigation Steps

Modify function rebase() to

function rebase(uint256 _profit, uint256 _epoch)
        external
        onlyRole(REBASE_ROLE)
    {
        uint256 currentTotalSupply = _totalSupply;
        require(_totalSupply > 0, "Can't rebase if not circulating");

        if (_profit == 0) {
            emit LogSupply(_epoch, block.timestamp, currentTotalSupply);
            emit LogRebase(_epoch, 0, getIndex());
        } else {
            uint256 updatedTotalSupply = currentTotalSupply + _profit;

            if (updatedTotalSupply > MAX_SUPPLY) {
                updatedTotalSupply = MAX_SUPPLY;
            }

            rebasingCreditsPerToken = rebasingCredits / updatedTotalSupply;
            require(rebasingCreditsPerToken > 0, "Invalid change in supply");
            
            uint oldTotalSupply = _totalSupply;
            _totalSupply = updatedTotalSupply;

            _storeRebase(oldTotalSupply, _profit, _epoch);
        }
    }

[2022-06-infinity] QA report

tags: c4, 2022-06-yieldy, QA

require amount > 0 in mint function

• https://github.com/code-423n4/2022-06-yieldy/blob/524f3b83522125fb7d4677fa7a7e5ba5a2c0fe67/src/contracts/Yieldy.sol#L248

[2022-06-yieldy] gas optimization

tags: c4, 2022-06-yieldy, Gas

approve 2 times with the same address

• https://github.com/code-423n4/2022-06-yieldy/blob/524f3b83522125fb7d4677fa7a7e5ba5a2c0fe67/src/contracts/Staking.sol#L84-L91

not necessary require state

OZ version 0.8 will revert transaction if it's overflow/underflow, so we won't need require check here

• https://github.com/code-423n4/2022-06-yieldy/blob/524f3b83522125fb7d4677fa7a7e5ba5a2c0fe67/src/contracts/Yieldy.sol#L190
• https://github.com/code-423n4/2022-06-yieldy/blob/524f3b83522125fb7d4677fa7a7e5ba5a2c0fe67/src/contracts/Yieldy.sol#L210
• https://github.com/code-423n4/2022-06-yieldy/blob/524f3b83522125fb7d4677fa7a7e5ba5a2c0fe67/src/contracts/LiquidityReserve.sol#L64-L66

store CURVE_POOL variable into stack instead of call storage 3 times

• https://github.com/code-423n4/2022-06-yieldy/blob/524f3b83522125fb7d4677fa7a7e5ba5a2c0fe67/src/contracts/Staking.sol#L633-L635

not necessary checking _isClaimAvailable(_recipient) because check is already in claim() function

• https://github.com/code-423n4/2022-06-yieldy/blob/524f3b83522125fb7d4677fa7a7e5ba5a2c0fe67/src/contracts/Staking.sol#L428-L430