Kuiper contest - WatchPug's results

Handle

WatchPug

Vulnerability details

Given that Basket is deployed as a proxied contract, it should use the Upgradeable variant of OpenZeppelin Contracts.

https://github.com/code-423n4/2021-12-defiprotocol/blob/205d3766044171e325df6a8bf2e79b37856eece1/contracts/contracts/Factory.sol#L97-L120

function createBasket(uint256 idNumber) external override nonReentrant returns (IBasket) {
    Proposal memory bProposal = _proposals[idNumber];
    require(bProposal.basket == address(0));

    IAuction newAuction = IAuction(Clones.clone(address(auctionImpl)));
    IBasket newBasket = IBasket(Clones.clone(address(basketImpl)));

    _proposals[idNumber].basket = address(newBasket);

    newAuction.initialize(address(newBasket), address(this));
    newBasket.initialize(bProposal, newAuction);

    for (uint256 i = 0; i < bProposal.weights.length; i++) {
        IERC20 token = IERC20(bProposal.tokens[i]);
        token.safeTransferFrom(msg.sender, address(this), bProposal.weights[i]);
        token.safeApprove(address(newBasket), bProposal.weights[i]);
    }

    newBasket.mintTo(BASE, msg.sender);

    emit BasketCreated(address(newBasket));

    return newBasket;
}

Otherwise, the constructor functions of Basket's parent contract which may change storage at deploy time, won't work for clone instances.

The effect may be different for different OpenZeppelin libraries.

Take ReentrancyGuard for example, the code inside ReentrancyGuard.sol#constructor won't work, should use ReentrancyGuardUpgradeable.sol instead:

https://github.com/code-423n4/2021-12-defiprotocol/blob/205d3766044171e325df6a8bf2e79b37856eece1/contracts/contracts/Basket.sol#L5-L7

import { ERC20Upgradeable } from "@openzeppelin/contracts-upgradeable/token/ERC20/ERC20Upgradeable.sol";
import { Ownable } from "@openzeppelin/contracts/access/Ownable.sol";
import { ReentrancyGuard } from "@openzeppelin/contracts/security/ReentrancyGuard.sol";

https://github.com/code-423n4/2021-12-defiprotocol/blob/205d3766044171e325df6a8bf2e79b37856eece1/contracts/contracts/Basket.sol#L14-L14

contract Basket is IBasket, ERC20Upgradeable, ReentrancyGuard {

https://github.com/code-423n4/2021-12-defiprotocol/blob/205d3766044171e325df6a8bf2e79b37856eece1/contracts/contracts/Basket.sol#L44-L61

function initialize(IFactory.Proposal memory proposal, IAuction auction_) external override {
    require(address(factory) == address(0));
    require(!initialized);

    publisher = proposal.proposer;
    licenseFee = proposal.licenseFee;
    factory = IFactory(msg.sender);
    auction = auction_;
    ibRatio = BASE;
    tokens = proposal.tokens;
    weights = proposal.weights;
    maxSupply = proposal.maxSupply;
    approveUnderlying(address(auction));

    __ERC20_init(proposal.tokenName, proposal.tokenSymbol);

    initialized = true;
}

Recommendation

Change to:

import { Initializable } from "@openzeppelin/contracts-upgradeable/proxy/utils/Initializable.sol";
import { ERC20Upgradeable } from "@openzeppelin/contracts-upgradeable/token/ERC20/ERC20Upgradeable.sol";
import { Ownable } from "@openzeppelin/contracts/access/Ownable.sol";
import { ReentrancyGuardUpgradeable } from "@openzeppelin/contracts-upgradeable/security/ReentrancyGuardUpgradeable.sol";

contract Basket is IBasket, ERC20Upgradeable, ReentrancyGuardUpgradeable {

function initialize(IFactory.Proposal memory proposal, IAuction auction_) external initializer override {
    require(address(factory) == address(0));

    publisher = proposal.proposer;
    licenseFee = proposal.licenseFee;
    factory = IFactory(msg.sender);
    auction = auction_;
    ibRatio = BASE;
    tokens = proposal.tokens;
    weights = proposal.weights;
    maxSupply = proposal.maxSupply;
    approveUnderlying(address(auction));

    __ERC20_init(proposal.tokenName, proposal.tokenSymbol);
    __ReentrancyGuard_init();
}

Handle

WatchPug

Vulnerability details

https://github.com/code-423n4/2021-12-defiprotocol/blob/205d3766044171e325df6a8bf2e79b37856eece1/contracts/contracts/Factory.sol#L40-L42

function setMinLicenseFee(uint256 newMinLicenseFee) public override onlyOwner {
    minLicenseFee = newMinLicenseFee;
}

Factory allows minLicenseFee to be 0.

But in the current implementation, publisher cannot set licenseFee to 0 with Basket#changeLicenseFee().

https://github.com/code-423n4/2021-12-defiprotocol/blob/205d3766044171e325df6a8bf2e79b37856eece1/contracts/contracts/Basket.sol#L177-L192

function changeLicenseFee(uint256 newLicenseFee) onlyPublisher public override {
    require(newLicenseFee >= factory.minLicenseFee() && newLicenseFee != licenseFee);
    if (pendingLicenseFee.licenseFee != 0 && pendingLicenseFee.licenseFee == newLicenseFee) {
        require(block.timestamp >= pendingLicenseFee.timestamp + TIMELOCK_DURATION);
        licenseFee = newLicenseFee;

        pendingLicenseFee.licenseFee = 0;

        emit ChangedLicenseFee(licenseFee);
    } else {
        pendingLicenseFee.licenseFee = newLicenseFee;
        pendingLicenseFee.timestamp = block.timestamp;

        emit NewLicenseFeeSubmitted(newLicenseFee);
    }
}

The check if (pendingLicenseFee.licenseFee != 0 && ...) { at L179 only allows licenseFee to be none 0 values for pendingLicenseFee.licenseFee.

Recommendation

Consider adding pendingLicenseFee.pending to check if there is a pending licenseFee.

Handle

WatchPug

Vulnerability details

Reading array length at each iteration of the loop takes 6 gas (3 for mload and 3 to place memory_offset) in the stack.

Caching the array length in the stack saves around 3 gas per iteration.

Instances include:

https://github.com/code-423n4/2021-12-defiprotocol/blob/205d3766044171e325df6a8bf2e79b37856eece1/contracts/contracts/Basket.sol#L79-L79

for (uint256 x = 0; x < tokenList.length; x++) {

https://github.com/code-423n4/2021-12-defiprotocol/blob/205d3766044171e325df6a8bf2e79b37856eece1/contracts/contracts/Basket.sol#L275-L275

for (uint256 i = 0; i < weights.length; i++) {

https://github.com/code-423n4/2021-12-defiprotocol/blob/205d3766044171e325df6a8bf2e79b37856eece1/contracts/contracts/Basket.sol#L282-L282

for (uint256 i = 0; i < weights.length; i++) {

https://github.com/code-423n4/2021-12-defiprotocol/blob/205d3766044171e325df6a8bf2e79b37856eece1/contracts/contracts/Basket.sol#L289-L289

for (uint256 i = 0; i < weights.length; i++) {

https://github.com/code-423n4/2021-12-defiprotocol/blob/205d3766044171e325df6a8bf2e79b37856eece1/contracts/contracts/Auction.sol#L105-L105

for (uint256 i = 0; i < pendingWeights.length; i++) {

Handle

WatchPug

Vulnerability details

Using ++i is more gas efficient than i++, especially in a loop.

We suggest to use unchecked {++i} to even better gas performance.

For example:

https://github.com/code-423n4/2021-12-defiprotocol/blob/205d3766044171e325df6a8bf2e79b37856eece1/contracts/contracts/Factory.sol#L109-L109

for (uint256 i = 0; i < bProposal.weights.length; i++) {

https://github.com/code-423n4/2021-12-defiprotocol/blob/205d3766044171e325df6a8bf2e79b37856eece1/contracts/contracts/Auction.sol#L152-L152

for (uint256 i = 0; i < bountyIds.length; i++) {

https://github.com/code-423n4/2021-12-defiprotocol/blob/205d3766044171e325df6a8bf2e79b37856eece1/contracts/contracts/Basket.sol#L282-L282

for (uint256 i = 0; i < weights.length; i++) {

Handle

WatchPug

Vulnerability details

https://github.com/code-423n4/2021-12-defiprotocol/blob/205d3766044171e325df6a8bf2e79b37856eece1/contracts/contracts/Basket.sol#L133-L153

function handleFees(uint256 startSupply) private {
    if (lastFee == 0) {
        lastFee = block.timestamp;
    } else if (startSupply == 0) {
        return;
    } else {
        uint256 timeDiff = (block.timestamp - lastFee);
        uint256 feePct = timeDiff * licenseFee / ONE_YEAR;
        uint256 fee = startSupply * feePct / (BASE - feePct);


        _mint(publisher, fee * (BASE - factory.ownerSplit()) / BASE);
        _mint(Ownable(address(factory)).owner(), fee * factory.ownerSplit() / BASE);
        lastFee = block.timestamp;

        uint256 newIbRatio = ibRatio * startSupply / totalSupply();
        ibRatio = newIbRatio;

        emit NewIBRatio(ibRatio);
    }
}

timeDiff in Basket.sol#handleFees() can be 0 when there are multiple mint and burn transactions in the same block. Check if timeDiff > 0 can save gas from unnecessary code execution like mint with amount 0.

Recommended Mitigation Steps

Change to:

function handleFees(uint256 startSupply) private {
    if (lastFee == 0) {
        lastFee = block.timestamp;
    } else if (startSupply == 0) {
        return;
    } else {
        uint256 timeDiff = (block.timestamp - lastFee);
        if (timeDiff == 0) return;
        uint256 feePct = timeDiff * licenseFee / ONE_YEAR;
        uint256 fee = startSupply * feePct / (BASE - feePct);


        _mint(publisher, fee * (BASE - factory.ownerSplit()) / BASE);
        _mint(Ownable(address(factory)).owner(), fee * factory.ownerSplit() / BASE);
        lastFee = block.timestamp;

        uint256 newIbRatio = ibRatio * startSupply / totalSupply();
        ibRatio = newIbRatio;

        emit NewIBRatio(ibRatio);
    }
}

Handle

WatchPug

Vulnerability details

Every call to an external contract costs a decent amount of gas. For optimization of gas usage, external call results should be cached if they are being used for more than one time.

For example:

factory.ownerSplit() in Basket#handleFees()

https://github.com/code-423n4/2021-12-defiprotocol/blob/205d3766044171e325df6a8bf2e79b37856eece1/contracts/contracts/Basket.sol#L144-L145

_mint(publisher, fee * (BASE - factory.ownerSplit()) / BASE);
_mint(Ownable(address(factory)).owner(), fee * factory.ownerSplit() / BASE);

Handle

WatchPug

Vulnerability details

Setting uint256 variables to 0 is redundant as they default to 0.

https://github.com/code-423n4/2021-12-defiprotocol/blob/205d3766044171e325df6a8bf2e79b37856eece1/contracts/contracts/Factory.sol#L34-L34

uint256 public override ownerSplit;

https://github.com/code-423n4/2021-12-defiprotocol/blob/205d3766044171e325df6a8bf2e79b37856eece1/contracts/contracts/Factory.sol#L19-L23

constructor (IAuction _auctionImpl, IBasket _basketImpl) {
    auctionImpl = _auctionImpl;
    basketImpl = _basketImpl;
    ownerSplit = 0; //TODO: needed?
}

Recommendation

Consider removing ownerSplit = 0;, make the code simpler and save some gas.

Handle

WatchPug

Vulnerability details

https://github.com/code-423n4/2021-12-defiprotocol/blob/205d3766044171e325df6a8bf2e79b37856eece1/contracts/contracts/Basket.sol#L266-L272

function updateIBRatio(uint256 newRatio) onlyAuction external override returns (uint256) {
        ibRatio = newRatio;

        emit NewIBRatio(ibRatio);

        return ibRatio;
    }

The parameter of NewIBRatio can use newRatio directly to avoid unnecessary storage read of ibRatio to save some gas.

Recommendation

Change to:

function updateIBRatio(uint256 newRatio) onlyAuction external override returns (uint256) {
        ibRatio = newRatio;

        emit NewIBRatio(newRatio);

        return newRatio;
    }

Handle

WatchPug

Vulnerability details

For the storage variables that will be accessed multiple times, cache and read from the stack can save ~100 gas from each extra read (SLOAD after Berlin).

For example:

ibRatio is used in for loop, cache and read from the stack can save gas.

https://github.com/code-423n4/2021-12-defiprotocol/blob/205d3766044171e325df6a8bf2e79b37856eece1/contracts/contracts/Basket.sol#L288-L294

function pullUnderlying(uint256 amount, address from) private {
        for (uint256 i = 0; i < weights.length; i++) {
            uint256 tokenAmount = amount * weights[i] * ibRatio / BASE / BASE;
            require(tokenAmount > 0);
            IERC20(tokens[i]).safeTransferFrom(from, address(this), tokenAmount);
        }
    }

Recommendation

Change to:

function pullUnderlying(uint256 amount, address from) private {
        uint256 _ibRatio = ibRatio;
        for (uint256 i = 0; i < weights.length; i++) {
            uint256 tokenAmount = amount * weights[i] * _ibRatio / BASE / BASE;
            require(tokenAmount > 0);
            IERC20(tokens[i]).safeTransferFrom(from, address(this), tokenAmount);
        }
    }

Handle

WatchPug

Vulnerability details

https://github.com/code-423n4/2021-12-defiprotocol/blob/205d3766044171e325df6a8bf2e79b37856eece1/contracts/contracts/Basket.sol#L67-L85

function validateWeights(address[] memory _tokens, uint256[] memory _weights) public override pure {
    require(_tokens.length > 0);
    require(_tokens.length == _weights.length);
    uint256 length = _tokens.length;
    address[] memory tokenList = new address[](length);

    // check uniqueness of tokens and not token(0)

    for (uint i = 0; i < length; i++) {
        require(_tokens[i] != address(0));
        require(_weights[i] > 0);

        for (uint256 x = 0; x < tokenList.length; x++) {
            require(_tokens[i] != tokenList[x]);
        }

        tokenList[i] = _tokens[i];
    }
}

for (uint256 x = 0; x < tokenList.length; x++) can be change to for (uint256 x = 0; x < i; x++) because the value of tokenList[i] has not been set yet.

Handle

WatchPug

Vulnerability details

https://github.com/code-423n4/2021-12-defiprotocol/blob/205d3766044171e325df6a8bf2e79b37856eece1/contracts/contracts/Basket.sol#L157-L173

function changePublisher(address newPublisher) onlyPublisher public override {
    require(newPublisher != address(0));

    if (pendingPublisher.publisher != address(0) && pendingPublisher.publisher == newPublisher) {
        require(block.timestamp >= pendingPublisher.timestamp + TIMELOCK_DURATION);
        publisher = newPublisher;

        pendingPublisher.publisher = address(0);

        emit ChangedPublisher(publisher);
    } else {
        // ...
    }
}

pendingPublisher.publisher will never be address(0) if newPublisher != address(0) and pendingPublisher.publisher == newPublisher.

Removing pendingPublisher.publisher != address(0) can make the code simpler and save some gas.

Recommendation

Remove the redundant assertion.

Handle

WatchPug

Vulnerability details

For the storage variables that will be accessed multiple times, cache and read from the stack can save ~100 gas from each extra read (SLOAD after Berlin).

For example:

https://github.com/code-423n4/2021-12-defiprotocol/blob/205d3766044171e325df6a8bf2e79b37856eece1/contracts/contracts/Basket.sol#L274-L279

function approveUnderlying(address spender) private {
        for (uint256 i = 0; i < weights.length; i++) {
            IERC20(tokens[i]).safeApprove(spender, 0);
            IERC20(tokens[i]).safeApprove(spender, type(uint256).max);
        }
    }

tokens[i] can be cached.

Recommendation

Change to:

function approveUnderlying(address spender) private {
        for (uint256 i = 0; i < weights.length; i++) {
            IERC20 token = IERC20(tokens[i]);
            token.safeApprove(spender, 0);
            token.safeApprove(spender, type(uint256).max);
        }
    }

Handle

WatchPug

Vulnerability details

The current implementation of auctionOngoing is switching between true and false.

SSTORE from false (0) to true (1) (or any non-zero value), the cost is 20000; SSTORE from 1 to 2 (or any other non-zero value), the cost is 5000.

By storing the original value once again, a refund is triggered (https://eips.ethereum.org/EIPS/eip-2200).

Since refunds are capped to a percentage of the total transaction's gas, it is best to keep them low, to increase the likelihood of the full refund coming into effect.

Therefore, switching between 1, 2 instead of false (0), true (1) will be more gas efficient.

See: https://github.com/OpenZeppelin/openzeppelin-contracts/blob/86bd4d73896afcb35a205456e361436701823c7a/contracts/security/ReentrancyGuard.sol#L29-L33

Recommendation

Change to:

    uint256 private constant _NOT_ONGOING = 1;
    uint256 private constant _ONGOING = 2;
    uint256 public override auctionOngoing;

    function startAuction() onlyBasket public override {
        require(auctionOngoing == false, 'ongoing auction');

        auctionOngoing = _ONGOING;
        // ...
    }

    function killAuction() onlyBasket public override {
        auctionOngoing = _NOT_ONGOING;
    }

    function initialize(address basket_, address factory_) public override {
        require(address(factory) == address(0));
        require(!initialized);

        basket = IBasket(basket_);
        factory = IFactory(factory_);
        auctionOngoing = _NOT_ONGOING;
        initialized = true;
    }

    function bondForRebalance() public override {
        require(auctionOngoing == _ONGOING);
        // ...
    }

    function settleAuction(
        uint256[] memory bountyIDs,
        address[] memory inputTokens,
        uint256[] memory inputWeights,
        address[] memory outputTokens,
        uint256[] memory outputWeights
    ) public nonReentrant override {
        require(auctionOngoing == _ONGOING);
        require(hasBonded);
        require(bondTimestamp + ONE_DAY > block.timestamp);
        require(msg.sender == auctionBonder);
        require(inputTokens.length == inputWeights.length);
        require(outputTokens.length == outputWeights.length);

        for (uint256 i = 0; i < inputTokens.length; i++) {
            IERC20(inputTokens[i]).safeTransferFrom(msg.sender, address(basket), inputWeights[i]);
        }

        for (uint256 i = 0; i < outputTokens.length; i++) {
            IERC20(outputTokens[i]).safeTransferFrom(address(basket), msg.sender, outputWeights[i]);
        }

        //TODO: name a and b or further split up
        uint256 a = factory.auctionMultiplier() * basket.ibRatio();
        uint256 b = (bondBlock - auctionStart) * BASE / factory.auctionDecrement();
        uint256 newRatio = a - b;

        (address[] memory pendingTokens, uint256[] memory pendingWeights, uint256 minIbRatio) = basket.getPendingWeights();
        require(newRatio >= minIbRatio);
        IERC20 basketAsERC20 = IERC20(address(basket));

        for (uint256 i = 0; i < pendingWeights.length; i++) {
            uint256 tokensNeeded = basketAsERC20.totalSupply() * pendingWeights[i] * newRatio / BASE / BASE;
            require(IERC20(pendingTokens[i]).balanceOf(address(basket)) >= tokensNeeded);
        }

        basket.setNewWeights();
        basket.updateIBRatio(newRatio);
        auctionOngoing = _NOT_ONGOING;
        hasBonded = false;

        basketAsERC20.safeTransfer(msg.sender, bondAmount);
        withdrawBounty(bountyIDs);

        emit AuctionSettled(msg.sender);
    }

    function bondBurn() external override {
        require(auctionOngoing == _ONGOING);
        require(hasBonded);
        require(bondTimestamp + ONE_DAY <= block.timestamp);

        basket.auctionBurn(bondAmount);
        hasBonded = false;
        auctionOngoing = _NOT_ONGOING;
        basket.deleteNewIndex();

        emit BondBurned(msg.sender, auctionBonder, bondAmount);

        auctionBonder = address(0);
    }

Handle

WatchPug

Vulnerability details

Functions can be defined outside of a contract, also called “free functions”, always have implicit internal visibility.

Every call to an external contract costs a decent amount of gas. For optimization of gas usage, use free functions to replace external calls can save gas.

For example:

Basket.sol#validateWeights() can be defined as a free function, so that Factory.sol#proposeBasketLicense() can save an external call.

https://github.com/code-423n4/2021-12-defiprotocol/blob/205d3766044171e325df6a8bf2e79b37856eece1/contracts/contracts/Factory.sol#L75-L75

basketImpl.validateWeights(tokens, weights);

Handle

WatchPug

Vulnerability details

There is no risk of overflow caused by increamenting the iteration index in for loops (the i++ in for for (uint256 i = 0; i < weights.length; i++)).

Increments perform overflow checks that are not necessary in this case.

Recommendation

Surround the increment expressions with an unchecked { ... } block to avoid the default overflow checks. For example, change the for loop:

https://github.com/code-423n4/2021-12-defiprotocol/blob/205d3766044171e325df6a8bf2e79b37856eece1/contracts/contracts/Basket.sol#L289-L293

for (uint256 i = 0; i < weights.length; i++) {
    uint256 tokenAmount = amount * weights[i] * ibRatio / BASE / BASE;
    require(tokenAmount > 0);
    IERC20(tokens[i]).safeTransferFrom(from, address(this), tokenAmount);
}

to

for (uint256 i = 0; i < weights.length;) {
    uint256 tokenAmount = amount * weights[i] * ibRatio / BASE / BASE;
    require(tokenAmount > 0);
    IERC20(tokens[i]).safeTransferFrom(from, address(this), tokenAmount);
    unchecked { ++i; }
}

Handle

WatchPug

Vulnerability details

For the arithmetic operations that will never over/underflow, using the unchecked directive (Solidity v0.8 has default overflow/underflow checks) can save some gas from the unnecessary internal over/underflow checks.

For example:

https://github.com/code-423n4/2021-12-defiprotocol/blob/205d3766044171e325df6a8bf2e79b37856eece1/contracts/contracts/Auction.sol#L139-L145

_bounties.push(Bounty({
    token: address(token),
    amount: amount,
    active: true
}));

uint256 id = _bounties.length - 1;

_bounties.length - 1 will never underflow.

Handle

WatchPug

Vulnerability details

https://github.com/code-423n4/2021-12-defiprotocol/blob/205d3766044171e325df6a8bf2e79b37856eece1/contracts/contracts/Auction.sol#L49-L57

function initialize(address basket_, address factory_) public override {
    require(address(factory) == address(0));
    require(!initialized);

    basket = IBasket(basket_);
    factory = IFactory(factory_);
    initialized = true;
}

Auction.sol#initialize() is using the factory_ parameter as the value of factory, while Basket.sol#initialize() uses msg.sender.

https://github.com/code-423n4/2021-12-defiprotocol/blob/205d3766044171e325df6a8bf2e79b37856eece1/contracts/contracts/Basket.sol#L44-L61

function initialize(IFactory.Proposal memory proposal, IAuction auction_) external override {
    require(address(factory) == address(0));
    require(!initialized);

    publisher = proposal.proposer;
    licenseFee = proposal.licenseFee;
    factory = IFactory(msg.sender);
    auction = auction_;
    ibRatio = BASE;
    tokens = proposal.tokens;
    weights = proposal.weights;
    maxSupply = proposal.maxSupply;
    approveUnderlying(address(auction));

    __ERC20_init(proposal.tokenName, proposal.tokenSymbol);

    initialized = true;
}

Consider changing to msg.sender and removing the factory_ parameter for the purpose of consistency and gas saving.

Handle

WatchPug

Vulnerability details

https://github.com/code-423n4/2021-12-defiprotocol/blob/205d3766044171e325df6a8bf2e79b37856eece1/contracts/contracts/Basket.sol#L44-L61

function initialize(IFactory.Proposal memory proposal, IAuction auction_) external override {
    require(address(factory) == address(0));
    require(!initialized);

    publisher = proposal.proposer;
    licenseFee = proposal.licenseFee;
    factory = IFactory(msg.sender);
    auction = auction_;
    ibRatio = BASE;
    tokens = proposal.tokens;
    weights = proposal.weights;
    maxSupply = proposal.maxSupply;
    approveUnderlying(address(auction));

    __ERC20_init(proposal.tokenName, proposal.tokenSymbol);

    initialized = true;
}

factory will always be address(0) when initialized == false as the only way to set factory is initialize().

Removing require(address(factory) == address(0)); can make the code simpler and save some gas.

Recommendation

Remove the redundant assertion at L45.

Handle

WatchPug

Vulnerability details

The following source units are imported but not referenced in the contract:

https://github.com/code-423n4/2021-12-defiprotocol/blob/205d3766044171e325df6a8bf2e79b37856eece1/contracts/contracts/Auction.sol#L8-L8

import "hardhat/console.sol";

https://github.com/code-423n4/2021-12-defiprotocol/blob/205d3766044171e325df6a8bf2e79b37856eece1/contracts/contracts/Basket.sol#L11-L11

import "hardhat/console.sol";

https://github.com/code-423n4/2021-12-defiprotocol/blob/205d3766044171e325df6a8bf2e79b37856eece1/contracts/contracts/Factory.sol#L3-L3

import "hardhat/console.sol";

Recommendation

Check all imports and remove all unused/unreferenced and unnecessary imports.