Platform: Code4rena
Start Date: 10/03/2022
Pot Size: $75,000 USDT
Total HM: 25
Participants: 54
Period: 7 days
Judge: pauliax
Total Solo HM: 10
Id: 97
League: ETH
Rank: 31/54
Findings: 3
Award: $277.69
🌟 Selected for report: 0
🚀 Solo Findings: 0
The LiquidityPool.depositErc20 function takes a amount parameter but this parameter is not the actual transferred amount for fee-on-transfer / deflationary (or other rebasing) tokens.
The actual deposited amount might be lower than the specified amount of the function parameter.
This would lead to wrong interest rate calculations on the principal.
Transfer the tokens first and compare pre-/after token balances to compute the actual deposited amount before emitting event and increasing the liquidity.
#0 - ankurdubey521
2022-03-30T15:49:32Z
Duplicate of #39
#1 - pauliax
2022-04-26T10:52:29Z
🌟 Selected for report: hickuphh3
Also found by: 0v3rf10w, 0x1f8b, 0xDjango, 0xNazgul, 0xngndev, 0xwags, Cantor_Dust, CertoraInc, Dravee, IllIllI, PPrieditis, Ruhum, TerrierLover, WatchPug, XDms, benk10, berndartmueller, bitbopper, catchup, cmichel, cryptphi, csanuragjain, danb, defsec, gzeon, hagrid, hubble, jayjonah8, kenta, kyliek, minhquanym, rfa, robee, saian, samruna, throttle, ye0lde, z3s
118.9599 USDT - $118.96
Input validation on address parameters checking for zero addresses is always recommended especially when they are used in token transfers.
There is a missing zero address checks on WhitelistPeriodManager:setLpToken function.
Perform zero address input validation on _lpToken parameter.
🌟 Selected for report: Dravee
Also found by: 0v3rf10w, 0x1f8b, 0xDjango, 0xNazgul, 0xngndev, 0xwags, Cantor_Dust, CertoraInc, IllIllI, Jujic, Kenshin, Kiep, PPrieditis, TerrierLover, Tomio, WatchPug, antonttc, benk10, berndartmueller, bitbopper, csanuragjain, defsec, gzeon, hagrid, hickuphh3, kenta, minhquanym, oyc_109, pedroais, peritoflores, rfa, robee, saian, samruna, sirhashalot, throttle, wuwe1, z3s
59.466 USDT - $59.47
10 ** 18 can be changed to 1e18 and save some gashttps://github.com/code-423n4/2022-03-biconomy/blob/main/contracts/hyphen/LiquidityProviders.sol#L27
uint256 public constant BASE_DIVISOR = 10**18;
can be changed to:
uint256 public constant BASE_DIVISOR = 1e18;
to optimise gas.