Kuiper contest - goatbug's results

Handle

goatbug

Vulnerability details

Impact

Long list of functions should be set from public to external since they are not called anywhere by the contract itself.

Proof of Concept

There are too many to list them all from all the contracts.

Just some examples in the Factory contract.

There are lots in every contract that should rather be external.

function setMinLicenseFee(uint256 newMinLicenseFee) public override onlyOwner {
    minLicenseFee = newMinLicenseFee;
}

function setAuctionDecrement(uint256 newAuctionDecrement) public override onlyOwner {
    auctionDecrement = newAuctionDecrement;
}

function setAuctionMultiplier(uint256 newAuctionMultiplier) public override onlyOwner {
    auctionMultiplier = newAuctionMultiplier;
}

function setBondPercentDiv(uint256 newBondPercentDiv) public override onlyOwner {
    bondPercentDiv = newBondPercentDiv;
}

function setOwnerSplit(uint256 newOwnerSplit) public override onlyOwner {
    require(newOwnerSplit <= 2e17); // 20%

    ownerSplit = newOwnerSplit;
}

Tools Used

Recommended Mitigation Steps

Handle

goatbug

Vulnerability details

Impact

uint256 private constant BLOCK_DECREMENT = 10000; BLOCK_DECREMENT declared but never used in Auction contract

Proof of Concept

Provide direct links to all referenced code in GitHub. Add screenshots, logs, or any other relevant proof that illustrates the concept.

Tools Used

Recommended Mitigation Steps

Handle

goatbug

Vulnerability details

Impact

Even if the same token is added as a bounty, they will be treated as seperate bounties and require 2 transfers of the same token to claim.

function addBounty(IERC20 token, uint256 amount) public override returns (uint256) {
    // add bounty to basket
    token.safeTransferFrom(msg.sender, address(this), amount);
    _bounties.push(Bounty({
        token: address(token),
        amount: amount,
        active: true
    }));

    uint256 id = _bounties.length - 1;
    emit BountyAdded(token, amount, id);
    return id;
}

Proof of Concept

Another optimization: Bounties further keep being added to the list and never deleted. Gas could be saved by removing bounties instead of setting their active flag to false.

Tools Used

Recommended Mitigation Steps

Handle

goatbug

Vulnerability details

Impact

All structs can be packed to use less storage slots.

struct PendingPublisher {
    address publisher;
    uint256 block;
}

struct PendingLicenseFee {
    uint256 licenseFee;
    uint256 block;
}

struct PendingWeights {
    address[] tokens;
    uint256[] weights;
    uint256 block;
    bool pending;
}

Proof of Concept

struct PendingPublisher {
    address publisher;
    uint256 block;
}

Block can likely be smaller and fit in to a uint88 etc packing into a single slot

struct PendingLicenseFee {
    uint256 licenseFee;
    uint256 block;
}

Each could be uint128 here.

struct PendingWeights {
    address[] tokens;
    uint256[] weights;
    uint256 block;
    bool pending;
}

block and pending packed together.

Tools Used

Recommended Mitigation Steps

Handle

goatbug

Vulnerability details

Impact

In createBasket (Factory), tokens are first transsferred from the creator, to the factory, before being approved and then transfered to the Basket.

The function is atomic and the tokens could simply be written to be transferred straight to Basket to save a lot of gas, especially on large numbers of tokens in a basket.

    for (uint256 i = 0; i < bProposal.weights.length; i++) {
        IERC20 token = IERC20(bProposal.tokens[i]);
        token.safeTransferFrom(msg.sender, address(this), bProposal.weights[i]);
        token.safeApprove(address(newBasket), bProposal.weights[i]);
    }

    newBasket.mintTo(BASE, msg.sender);

Proof of Concept

Provide direct links to all referenced code in GitHub. Add screenshots, logs, or any other relevant proof that illustrates the concept.

Tools Used

Recommended Mitigation Steps

Handle

goatbug

Vulnerability details

Impact

2 slots instead of 3

Proof of Concept

struct Bounty {
    address token;
    uint256 amount;
    bool active;
}

having token and active lines consecutive can pack those two values into single 256 bit slot. Result is packing this struct into 2 256 slots as opposed to 3.

Tools Used

Recommended Mitigation Steps