Yieldy contest - dipp's results

L-01: setAffiliateFee in Staking.sol does not enforce the upper limit

Line References

Staking.sol#L167-L170

Impact

An upper limit should be enforced when setting a new fee (as in LiquidityReserve.sol:setFee), to prevent the fee from being accidently set to BASIS_POINT or more which could result in broken functionality throughout the Staking.sol contract including in the _sendAffiliateFee function.

Recommmended Mitigation Steps

Set a condition in setAffiliateFee that prevents the fee from being set to more than BASIS_POINTS. Ideally a max fee variable should be used which is much less than 100%.

L-02: Deflationary/fee-on-transfer staking tokens are not supported

Line References

Staking.sol#L419-L423

Impact

If STAKING_TOKEN is a token that charges a fee on transfer then the stake function in Staking.sol might revert.

Proof of Concept

_depositFor function in Tokemak's Staking.sol(https://github.com/Tokemak/tokemak-smart-contracts-public/blob/main/contracts/staking/Staking.sol#L410):

tokeToken.safeTransferFrom(msg.sender, address(this), amount);

After the staking token is transferred to Yieldy Staking.sol, the amount is then deposited into Tokemak where the transaction will revert in the line shown above due to the Yieldy staking contract not having enough staking tokens .

Recommmended Mitigation Steps

When staking tokens are transferred into Staking.sol, check the balances before and after the transfer and use the difference of the balances instead of the supplied amount.