Badger Citadel contest - csanuragjain's results

Bringing BTC to DeFi

General Information

Platform: Code4rena

Start Date: 14/04/2022

Pot Size: $75,000 USDC

Total HM: 8

Participants: 72

Period: 7 days

Judge: Jack the Pug

Total Solo HM: 2

Id: 110

League: ETH

BadgerDAO

Findings Distribution

Researcher Performance

Rank: 33/72

Findings: 2

Award: $258.19

🌟 Selected for report: 0

🚀 Solo Findings: 0

Funding.sol#L414: updateCitadelPriceInAsset function

If updateCitadelPriceInAsset resulted in invalid price,citadelPriceFlag is set to true. After sometime if same function is called and price come correctly then citadelPriceFlag should be set to false so that deposit are not impacted but this is not done.

Recommendation : Put citadelPriceFlag to false in case if price is in valid range

Funding.sol#L356: setDiscountLimits function

Add check _minDiscount<_maxDiscount (otherwise minDiscount could exceed maxDiscount)

SupplySchedule.sol#L150: setEpochRate function

check _rate!=0 (since 0 is an invalid input)

SupplySchedule.sol#L178: getMintableDebug

The condition require(lastMintTimestamp > globalStartTimestamp,"SupplySchedule: attempting to mint before start block"); does not cover valid case where lastMintTimestamp=globalStartTimestamp

Recommendation: Change to require(lastMintTimestamp >= globalStartTimestamp,"SupplySchedule: attempting to mint before start block");

StakedCitadelVester.sol#L108: claimableBalance function

If user revests then unlockEnd date will change. This will become a problem if user has already claimed major portion because after user revests now locked<claimed which means function will always fail

Recommendation: add check

((locked * (block.timestamp - vesting[recipient].unlockBegin)) /(vesting[recipient].unlockEnd - vesting[recipient].unlockBegin)) >= claimed

StakedCitadelVester.sol#L163: setVestingDuration function

Add a check for _duration!=0 (as 0 vesting duration is invalid)

#0 - jack-the-pug

2022-06-05T15:18:43Z

Funding.sol#L414: updateCitadelPriceInAsset function is a good one!

CitadelMinter.sol#L250: setFundingPoolWeight function Directly assign totalFundingPoolWeight=totalFundingPoolWeight-fundingPoolWeights[_pool]+_weight instead of using temp variable

SupplySchedule.sol#L84: getMintable function

check if endingEpoch==0 return 0 which will save some gas

AuditHub

A portfolio for auditors, a security profile for protocols, a hub for web3 security.

Built bymalatrax © 2024

Auditors

Browse

Contests

Browse

Get in touch

ContactTwitter