Yieldy contest - asutorufos's results

Lines of code

https://github.com/code-423n4/2022-06-yieldy/blob/main/src/contracts/Staking.sol#:~:text=function%20transferToke(,%7D

Vulnerability details

Impact

There are ERC20 tokens that may make certain customizations to their ERC20 contracts. One type of these tokens is deflationary tokens that charge a certain fee for every transfer() or transferFrom().

Proof of Concept

https://github.com/code-423n4/2022-06-yieldy/blob/main/src/contracts/Staking.sol#:~:text=Invalid%20address%22)%3B-,uint256%20totalTokeAmount%20%3D%20IERC20Upgradeable(TOKE_TOKEN).balanceOf(,)%3B,-%7D

When IERC20Upgradeable(TOKE_TOKEN) get set to totalTokeAmount it will be different once safetransfer have fees as some types of tokens may charge a certain fee for transfer and transferfrom.

It may be better to get the before balance then safetransferfrom then get the after balance to make sure no fees were added.

Tools Used

Manual Review

G-1 - Use != 0 instead of > 0 for Unsigned Integer Comparison When dealing with unsigned integer types, comparisons with != 0 are cheaper then with > 0. Staking.sol L#118 Staking.sol L#410 [Staking.sol L#572]https://github.com/code-423n4/2022-06-yieldy/blob/main/src/contracts/Staking.sol#:~:text=)%20external%20%7B-,require(_amount%20%3E%200%2C%20%22Invalid%20amount%22)%3B,-//%20prevent%20unstaking%20if [Staking.sol L#604]https://github.com/code-423n4/2022-06-yieldy/blob/main/src/contracts/Staking.sol#:~:text=%7B-,require(_amount%20%3E%200%2C%20%22Invalid%20amount%22)%3B,-require( Yieldy.sol L#83 Yieldy.sol L#96

G-2 STATE VARIABLES ONLY SET IN THE CONSTRUCTOR SHOULD BE DECLARED IMMUTABLE Avoids a Gsset (20000 gas)

Migration.sol L#14 Migration.sol L#15 Migration.sol L#16

G-3 VISIBILITY: PUBLIC FUNCTIONS TO EXTERNAL The following functions could be set external to save gas and improve code quality. External call cost is less expensive than of public functions. Yieldy.sol L#138 Yieldy.sol L#147 Yieldy.sol L#160 Yieldy.sol L#172 Yieldy.sol L#182 Yieldy.sol L#227