yAxis contest - gzeon's results

Handle

gzeon

Vulnerability details

Impact

Incorrect event emitted on BorrowFee update.

Proof of Concept

https://github.com/code-423n4/2021-11-yaxis/blob/146febcb61ae7fe20b0920849c4f4bbe111c6ba7/contracts/v3/alchemix/Alchemist.sol#L299

Recommended Mitigation Steps

Add around L78 event BorrowFeeUpdated(uint256 fee); Replace L299 emit BorrowFeeUpdated(_borrowFee);

Handle

gzeon

Vulnerability details

Proof of Concept

https://github.com/code-423n4/2021-11-yaxis/blob/146febcb61ae7fe20b0920849c4f4bbe111c6ba7/contracts/v3/alchemix/Alchemist.sol#L625 borrowFee can be cached in memory, i.e.

uint256 _borrowFee = borrowFee;
            if (_borrowFee > 0) {
                uint256 _borrowFeeAmount = _remainingAmount.mul(_borrowFee).div(
                    PERCENT_RESOLUTION
                );
                _cdp.totalDebt = _cdp.totalDebt.add(_borrowFeeAmount);
                xtoken.mint(rewards, _borrowFeeAmount);
            }

Handle

gzeon

Vulnerability details

Impact

onlyAdmin of YaxisVaultAdapter.sol is only used in withdraw, it is advised to inline the function to save some gas without losing readability.

Proof of Concept

https://github.com/code-423n4/2021-11-yaxis/blob/146febcb61ae7fe20b0920849c4f4bbe111c6ba7/contracts/v3/alchemix/adapters/YaxisVaultAdapter.sol#L37

Handle

gzeon

Vulnerability details

Proof of Concept

https://github.com/code-423n4/2021-11-yaxis/blob/146febcb61ae7fe20b0920849c4f4bbe111c6ba7/contracts/v3/alchemix/Alchemist.sol#L630 The line can be rewritten as _remainingAmount = _remainingAmount.add(_borrowFeeAmount); to reduce a storage write. Alternatively use a memory variable to preserve code readability.