Asymmetry contest - georgits's results

A protocol to help diversify and decentralize liquid staking derivatives.

General Information

Platform: Code4rena

Start Date: 24/03/2023

Pot Size: $49,200 USDC

Total HM: 20

Participants: 246

Period: 6 days

Judge: Picodes

Total Solo HM: 1

Id: 226

League: ETH

Asymmetry Finance

Findings Distribution

Researcher Performance

Rank: 131/246

Findings: 2

Award: $23.92

QA:
grade-b
Gas:
grade-b

๐ŸŒŸ Selected for report: 0

๐Ÿš€ Solo Findings: 0

Use latest Solidity version with a stable pragma statement

WstEth.sol, Reth.sol, SfrxEth.sol, SafEth.sol

Pass address values to initialize() instead of hardcoding them as constants

WstEth.sol - 13-18

SfrxEth.sol - 14-21

Reth.sol - 20-27

Missing zero address checks

WstEth.sol - 33

SfrxEth.sol - 36

Reth.sol - 42

SafEth.sol - 183

Use constants instead of magic numbers(10 ** 18)

WstEth.sol - 60, 87

SfrxEth.sol - 74, 113, 115

Reth.sol - 173, 214, 215, 241

SafEth.sol - 55, 75, 80, 81, 94, 98

Missing check if the new derivative already exists

SafEth.sol - 186

Remove unused imports

Reth.sol - 5

SafEth.sol - 4, 5, 6, 7, 8

No need of if else statement

Reth.sol - 212-215

Use constants for hashes

Reth.sol - 69, 190, 232, 124, 161

Missing input validation for _derivativeIndex, _derivativeIndex should not be greater than or equal to derivativeCount

SafEth.sol - 166, 203

Missing input validation for _minAmount, _minAmount should not be greater than or equal to maxAmount

SafEth.sol - 215

Missing input validation for _maxAmount , _maxAmount should not be less than or equal to minAmount

SafEth.sol - 224

Wrong NatSpec

SafEth.sol - 158 The function doesnโ€™t add a new derivative to the index fund

Remove unnecessary receive() method

WstEth.sol, SfrxEth.sol, Reth.sol

#0 - c4-sponsor

2023-04-07T22:20:54Z

elmutt marked the issue as sponsor confirmed

#1 - c4-judge

2023-04-24T19:06:41Z

Picodes marked the issue as grade-b

public functions not called internally can be declared external instead

Reth.sol - 50, 211, 221

SfrxEth.sol - 44, 122

WstEth.sol - 41, 86, 93

Cache storage variables instead of reading them in every iteration of the loop

SafEth.sol - 71, 84, 113, 140, 147, 171, 191

No need to iterate through the entire array to calculate totalWeigh, just add the new weight and remove the old one

SafEth.sol - 170-173 For example totalWeight = totalWeight + _weight - weights[_derivativeIndex];

No need to iterate through the entire array to calculate totalWeigh, just add _weight to it

SafEth.sol - 190-193 For example totalWeight = totalWeight + _weight

Emitting event with functions arguments is cheaper

SafEth.sol - 216, 225, 234, 243

(poolPrice() * 10 ** 18) / (10 ** 18) will always return poolPrice(), no need to multiply and divide

Reth.sol - 212

#0 - c4-sponsor

2023-04-07T22:21:17Z

elmutt marked the issue as sponsor confirmed

#1 - c4-judge

2023-04-23T19:31:34Z

Picodes marked the issue as grade-b

AuditHub

A portfolio for auditors, a security profile for protocols, a hub for web3 security.

Built bymalatrax ยฉ 2024

Auditors

Browse

Contests

Browse

Get in touch

ContactTwitter