veToken Finance contest - dipp's results

Lock more veAsset permanently.

General Information

Platform: Code4rena

Start Date: 26/05/2022

Pot Size: $75,000 USDT

Total HM: 31

Participants: 71

Period: 7 days

Judge: GalloDaSballo

Total Solo HM: 18

Id: 126

League: ETH

veToken Finance

Findings Distribution

Researcher Performance

Rank: 53/71

Findings: 1

Award: $103.42

🌟 Selected for report: 0

🚀 Solo Findings: 0

1.Incompatibility with deflationary/fee-on-transfer tokens

Line References

VE3DRewardPool.sol#L336-L339

Impact

The donate function in VE3DRewardPool.sol does not seem to support tokens whose balances change during a transfer, such as deflationary and fee-on-transfer tokens. The impact of this is that the rewardTokenInfo corresponding to that token may have incorrect values.

To account for these tokens, consider adding balance checks directly before and after the transfer of the tokens and use the difference to update the token info.

2. Missing zero address checks in constructors and setters

Line References

VE3DRewardPool.sol#L96-L100

VeTokenMinter.sol#L27

VeAssetDepositor.sol#L45-L48

VeAssetDepositor.sol#L53

VoterProxy.sol#L55

VoterProxy.sol#L62

Booster.sol#L111

Booster.sol#L116-L118

BaseRewardPool.sol#L103-L106

Impact

To ensure that necessary variable addresses aren't set to the zero address, consider adding zero address checks for all relevant addresses supplied as input to the constructors and setters.

#0 - GalloDaSballo

2022-07-07T00:03:02Z

1.Incompatibility with deflationary/fee-on-transfer tokens

Valid Low

2. Missing zero address checks in constructors and setters

Valid Low

2 L

AuditHub

A portfolio for auditors, a security profile for protocols, a hub for web3 security.

Built bymalatrax © 2024

Auditors

Browse

Contests

Browse

Get in touch

ContactTwitter