Platform: Code4rena
Start Date: 03/07/2023
Pot Size: $40,000 USDC
Total HM: 14
Participants: 74
Period: 7 days
Judge: alcueca
Total Solo HM: 9
Id: 259
League: ETH
Rank: 66/74
Findings: 1
Award: $6.07
🌟 Selected for report: 0
🚀 Solo Findings: 0
🌟 Selected for report: 0xprinc
Also found by: 0x11singh99, 0xAnah, 0xWaitress, 0xkazim, 2997ms, 33audits, 404Notfound, 8olidity, CRIMSON-RAT-REACH, CyberPunks, DanielWang888, Deekshith99, Eeyore, Eurovickk, Inspecktor, JGcarv, John, Jorgect, Kaysoft, LosPollosHermanos, MohammedRizwan, Qeew, QiuhaoLi, Rolezn, TheSavageTeddy, Topmark, Trust, Udsen, a3yip6, alexzoid, bigtone, codegpt, erebus, fatherOfBlocks, ginlee, glcanvas, hunter_w3b, josephdara, kaveyjoe, kutugu, mahdirostami, max10afternoon, oakcobalt, peanuts, pfapostol, ptsanev, qpzm, radev_sw, ravikiranweb3, sces60107, seth_lawson, te_aut, twcctop, zhaojie, ziyou-
6.0655 USDC - $6.07
functions/ConstantProduct2.sol
functions/ProportionalLPToken2.sol
pumps/MultiFlowPump.sol
Aquifer.sol
Well.sol
L45-75 - The documentation is not written as documentation, it does not use naspect.
L26-29/77-82 - The constants should all be together, to follow the solidity style rules. In addition to improving the understanding of the code.
L120 - That the contract is called Well and that the well() function returns the status of various functions is a bit of a message, perhaps thinking of a better name would be a better decision, since it reduces the level of understanding of the name. A better one might be getState() or getWellStorage().
L452/453/473/474/557/558/559/579/580 - The token array is traversed, without previously validating that the tokenAmountsIn arrays have the same length, this is important because it would generate an exception without being handled or it would be would execute without using all available tokenAmountsIn .
L203/417/425/774 - The _safeTransferFromFeeOnTransfer() function mentions in its name that there is a fee for transfers, but in the implementation there is no such logic, therefore the name of the function is wrong, this can generate confusion to contract users. This also renders the bool feeOnTransfer input of _addLiquidity() useless. The same thing happens with the swapFromFeeOnTransfer() function.
L730/759 - The _getIJ() function is not really necessary, since with _getJ() you could call it twice with a different J and get the same result. Therefore, it could be factored that way.
#0 - c4-pre-sort
2023-07-13T15:05:54Z
141345 marked the issue as high quality report
#1 - c4-pre-sort
2023-07-14T05:45:03Z
141345 marked the issue as low quality report
#2 - c4-judge
2023-08-04T20:58:15Z
alcueca marked the issue as grade-b