Wild Credit contest - defsec's results

Handle

defsec

Vulnerability details

Impact

With the migrateRewards function, owner can transfer all reward token into other address. Owner should distribute reward balance before migrating rewards.

Proof of Concept

1. Navigate to "https://github.com/code-423n4/2021-07-wildcredit/blob/82c48d73fd27a9d4d5d4a395b3affcef4ef6c5c8/contracts/RewardDistribution.sol"
2. See functionality on the "migrateRewards" function.
3. According to function, owner can transfer all reward balance to another address.

Tools Used

None

Recommended Mitigation Steps

Owner should distribute reward balance before migrating rewards.

Handle

defsec

Vulnerability details

Impact

There is occurrence in the code of the TransferHelper contract where amount is checked after the external call.

Proof of Concept

• Navigate to TransferHelper.sol
• Amount is checked after an external call. TransferHelper.sol amount check
• To favor readability and avoid confusions, consider applying check at the beginning of function.

Tools Used

None

Recommended Mitigation Steps

To favor readability and avoid confusions, consider applying check at the beginning of function.

  function _safeTransferFrom(address _token, address _sender, uint _amount) internal virtual {
    require(_amount > 0, "TransferHelper: amount must be > 0");
    ...
  }