Alchemix contest - bobirichman's results

QA Report

Table of content

• QA Findings
  • Initialize function frontrunning
  • Missing two steps verification process
  • Missing fee parameter validation

QA Findings

Initialize function frontrunning

Some contracts use an init function instead of a constructor. If the init function is not protected such that only the contract owner can call it then an attacker can call frontrun the function and the deployer lose the gas cost.Another critical thing is that since there is no explicit emission that allows monitoring it is not obvious that the deployer stop it at time.

• AlchemistV2.sol#L110
• CrossChainCanonicalAlchemicTokenV2.sol#L8
• CrossChainCanonicalGALCX.sol#L7
• TransmuterBuffer.sol#L78
• TransmuterV2.sol#L141

Missing two steps verification process

The process of transferring ownership is dangerous since typing the wrong address can lead to severe implications. It is better to have to steps verification process with set and claim functions to decrease the chances of human error.

• gALCX.sol
• gALCX.sol

Missing fee parameter validation

The fee parameter need to be validated since otherwise you may allow it to be 0 fee. And fee that is over 100% for example is also probably a mistake that can happen with the decimals.

• AlchemicTokenV2.sol#L92
• AlchemicTokenV2Base.sol#L98
• AlchemicTokenV2.sol#L92
• AlchemicTokenV2Base.sol#L98

Gas Report

Table of content

• Gas Optimizations
  • State variables that could be set immutable

Gas Optimizations

State variables that could be set immutable

You can set the following state variables to immutable and save gas:

• FuseTokenAdapterV1.sol: version
• RETHAdapterV1.sol: version
• VesperAdapterV1.sol: version
• AlchemistV2.sol: debtToken
• AlchemistV2.sol: whitelist