Yieldy contest - aga7hokakological's results

Access control missing for initialize() function

It is quite possible that while initializing contract it can be front-run and can be set by some malicious user which can cause trouble and loss of funds.

POC:

function initialize(
        address _stakingToken,
        address _yieldyToken,
        address _tokeToken,
        address _tokePool,
        address _tokeManager,
        address _tokeReward,
        address _liquidityReserve,
        address _feeAddress,
        address _curvePool,
        uint256 _epochDuration,
        uint256 _firstEpochEndTime
    ) external initializer { }

tools used:

manual analysis

use != instead of > in require statements to save gas

using > cost more than !=

POC:

https://github.com/code-423n4/2022-06-yieldy/blob/main/src/contracts/Staking.sol#L118 https://github.com/code-423n4/2022-06-yieldy/blob/main/src/contracts/Staking.sol#L410 https://github.com/code-423n4/2022-06-yieldy/blob/main/src/contracts/Staking.sol#L572 https://github.com/code-423n4/2022-06-yieldy/blob/main/src/contracts/Staking.sol#L604

Tools used:

Manual Analysis