Sushi Miso contest - itsmeSTYJ's results

Handle

itsmeSTYJ

Vulnerability details

Impact

If numerator is less than denominator when calculating priceDrop, it will return 0 since Solidity cannot express decimals i.e. the price drop intervals are too small.

Proof of Concept

https://github.com/sushiswap/miso/blob/2cdb1486a55ded55c81898b7be8811cb68cfda9e/contracts/Auctions/DutchAuction.sol#L331

If numerator is < denominator, the division will round down to 0.

A simple example:

• start price is 1 USDC (1 * 10**6)
• min price is 0.5 USDC (5 * 10**5)
• numerator is 1 USDC - 0.5 USDC = 0.5 USDC (5 * 10**5).

In order for this to go to 0, I just need to have auction duration longer than 500000 seconds or 5.8 days.

Handle

itsmeSTYJ

Vulnerability details

Impact

No impact, just gas optimization.

Proof of Concept

launcherInfo.liquidityAdded is only assigned in the finalize() function. On line 258, there is no need to add liquidity to the original value of liquidityAdded because liquidityAdded will always be 0 since you can only call finalize() once.

You can save a bit of gas simply by assigning it instead of adding first then assigning it i.e.

...
launcherInfo.liquidityAdded = BoringMath.to128(liquidity);
...

Handle

itsmeSTYJ

Vulnerability details

Impact

No impact, just a redundant parameter which might lead to wasted gas if the function is accidentally called wrongly.

Proof of Concept

deprecateFactory() accepts a _newAddress parameter that has to be the zero address or the function call will fail. This parameter is redundant.

Handle

itsmeSTYJ

Vulnerability details

Impact

Gas optimization

Proof of Concept

The require statement on line 201 in the PostAuctionLauncher.sol contract is redundant because:

1. launcherInfo.liquidityAdded is only updated in the finalize() function
2. You cannot call finalize() unless there are tokens deposited on both side
3. If you cannot call finalize(), line 201 will never be called because line 200 will always fail first.
4. If you manage to successfully pass line 200, it means that finalize() has been called and there will definitely be liquidity so this check is not needed.