Golom contest - auditor0517's results

Lines of code

https://github.com/code-423n4/2022-07-golom/blob/e5efa8f9d6dda92a90b8b2c4902320acf0c26816/contracts/rewards/RewardDistributor.sol#L298-L305

Vulnerability details

Impact

The ve address in RewardDistributor.sol will always be the zero address and the admin can't update it.

Proof of Concept

In the addVoteEscrow(), the ve address is set to zero address(pendingVoteEscrow) again because ve = 0 address at the first time.

Tools Used

Manual Review

Recommended Mitigation Steps

Recommend modifying like below.

function addVoteEscrow(address _voteEscrow) external onlyOwner {
    if (address(ve) == address(0)) {
        ve = VE(_voteEscrow);
    } else {
        voteEscrowEnableDate = block.timestamp + 1 days;
        pendingVoteEscrow = _voteEscrow;
    }
}

Lines of code

https://github.com/code-423n4/2022-07-golom/blob/e5efa8f9d6dda92a90b8b2c4902320acf0c26816/contracts/core/GolomTrader.sol#L381 https://github.com/code-423n4/2022-07-golom/blob/e5efa8f9d6dda92a90b8b2c4902320acf0c26816/contracts/core/GolomTrader.sol#L389-L394 https://github.com/code-423n4/2022-07-golom/blob/e5efa8f9d6dda92a90b8b2c4902320acf0c26816/contracts/core/GolomTrader.sol#L396-L399

Vulnerability details

Impact

Currently, it multiplies the amount twice for protocolfee and the users might receive smaller eth or the function might revert for uint underflow error.

Proof of Concept

The protocolfee is calculated correctly by multiplying the amount here.

But during calculation for the remaining ether amount, it multiplies the amount again at part1 and part2, so the calculation result might be different when amount > 1 with ERC1155 token.

Tools Used

Manual Review

Recommended Mitigation Steps

Recommend modifying this part like below.

if (o.refererrAmt > 0 && referrer != address(0)) {
    payEther(o.refererrAmt * amount, referrer);
    payEther(
        (o.totalAmt - o.exchange.paymentAmt - o.prePayment.paymentAmt - o.refererrAmt) * amount - p.paymentAmt - protocolfee,
        msg.sender
    );
} else {
    payEther(
        (o.totalAmt - o.exchange.paymentAmt - o.prePayment.paymentAmt) * amount - p.paymentAmt - protocolfee,
        msg.sender
    );
}