Platform: Code4rena
Start Date: 04/01/2022
Pot Size: $25,000 USDC
Total HM: 3
Participants: 40
Period: 3 days
Judge: Ivo Georgiev
Total Solo HM: 1
Id: 75
League: ETH
Rank: 24/40
Findings: 1
Award: $67.64
🌟 Selected for report: 0
🚀 Solo Findings: 0
30.2712 USDC - $30.27
hack3r-0m
https://github.com/XDeFi-tech/xdefi-distribution/blob/master/contracts/XDEFIDistribution.sol#L142
there is no incentive for end-users to call updateDistribution() function and hence the value of _pointsPerUnit being stale can result in improper calculations of distribution.
Manual Review
#0 - deluca-mike
2022-01-08T00:03:10Z
Agreed. We will call updateDistribution() before all locks, unlocks, and relocks.
#1 - deluca-mike
2022-01-09T11:06:46Z
Duplicate #30
37.3718 USDC - $37.37
hack3r-0m
https://github.com/XDeFi-tech/xdefi-distribution/blob/master/contracts/XDEFIDistribution.sol#L80
check the length of durations_ and multipliers is equal and revert if it is not resulting in gas savings rather than delayed revert.
#0 - deluca-mike
2022-01-08T03:17:06Z
We try to reduce gas costs for happy path, not for sad path. Assuming lengths are equal (which they will be in the overwhelming majority of the time), it is cheaper not to check them. Further, most wallets (and certainly the one we use) will alert the user if a transaction is going to fail, so it will never waste gas anyway.
#1 - deluca-mike
2022-01-09T11:00:41Z
Duplicate #38