PoolTogether - fatherOfBlocks's results

A protocol for no-loss prize savings

General Information

Platform: Code4rena

Start Date: 07/07/2023

Pot Size: $121,650 USDC

Total HM: 36

Participants: 111

Period: 7 days

Judge: Picodes

Total Solo HM: 13

Id: 258

League: ETH

PoolTogether

Findings Distribution

Researcher Performance

Rank: 91/111

Findings: 1

Award: $15.92

QA:
grade-b

🌟 Selected for report: 0

🚀 Solo Findings: 0

claimer/src/libraries/LinearVRGDALib.sol

  • L6 - toWadUnsafe, unsafeWadDiv functions are imported, but they are never used, therefore they generate more gas expense in the deploy and also generate a low understanding in the blockchain explorer.

  • L50 - A division is performed by an input of the function, this should include a prior validation that the input != 0, so as not to generate an unhandled exception.

claimer/src/Claimer.sol

  • L37 - No validation is performed in the constructor and the variables are immutable, therefore they should be validated before setting the variable to != 0x.

  • L63/64/68/69 - An array is used to traverse another, since it is not validated that they have the same length, this could generate problems, lack of traversal or generate an unhandled exception.

prize-pool/src/libraries/TierCalculationLib.sol

  • L23/33 - A division is performed by an input of the function, this should include a prior validation that the input != 0, so as not to generate an unhandled exception.

prize-pool/src/libraries/UD34x4.sol

  • L5 - uMAX_UD60x18 function is imported, but it is never used, therefore it generate more gas expense in the deploy and also generate a low understanding in the blockchain explorer.

prize-pool/src/PrizePool.sol

  • L4 - console2 is imported and this type of code for testing should be removed in a final version.

  • L8/12 - fromSD59x18, fromUD60x18toUD34x4 and toUD34x4 functions are imported, but they are never used, therefore they generate more gas expense in the deploy and also generate a low understanding in the blockchain explorer.

  • L258 - No validation is performed in the constructor and the variables are immutable, therefore they should be validated before setting the variable to != 0x.

vault/src/Vault.sol

  • L609/610/618/619 - An array is used to traverse another, since it is not validated that they have the same length, this could generate problems, lack of traversal or generate an unhandled exception.

  • L873/886/904 - A division is performed by the _rounding input and it is not validated that it is != 0. This should be validated so as not to generate an unhandled exception.

prize-pool/src/abstract/TieredLiquidityDistributor.sol

  • L235 - No validation is performed in the constructor and the variables are immutable, therefore they should be validated before setting the variable to != 0x.

  • L599 - A division is made by the _fractionalPrizeCount input and it is not validated that it is != 0. This should be validated so as not to generate an unhandled exception.

#0 - c4-judge

2023-07-18T19:18:49Z

Picodes marked the issue as grade-b

#1 - PierrickGT

2023-09-08T22:55:38Z

No links to the code, so impossible to debug now that it has changed.

AuditHub

A portfolio for auditors, a security profile for protocols, a hub for web3 security.

Built bymalatrax © 2024

Auditors

Browse

Contests

Browse

Get in touch

ContactTwitter