Amun contest - itsmeSTYJ's results

Handle

itsmeSTYJ

Vulnerability details

Impact

In the event that a premature division causes the result to round down to 0, the rest of the calculation would be wrong. It is always better to err on the side of caution and perform all multiplications first before any division.

Recommended Mitigation Steps

// Replace this
totalSupply.mul(annualizedFee).div(10**18).mul(timePassed).div(
    365 days
);
// with this
totalSupply.mul(annualizedFee).mul(timePassed).div(HUNDRED_PERCENT).div(365 days);

Handle

itsmeSTYJ

Vulnerability details

Impact

Some tokens e.g. USDT requires you to set allowance to 0 first before you can approve again so when you try to call _maxApprove() / approve() via singleCall() , it will fail unless you set allowance to 0 first.

That said however, there is no immediate impact for this bug thanks to the allowance w< balance check i.e. it will take many many many trades for allowance to be less than balance but when that happens, your contracts will be broken as there are no other functions to modify allowances.

Recommended Mitigation Steps

To handle tokens like USDT (that requires you to set allowance to 0 first before approving), it is recommended to set allowance to 0 then approve again.

Handle

itsmeSTYJ

Vulnerability details

Impact

Gas optimisation

Proof of Concept

Instead of doing amountsOut.length - 1, you can simply replace this with 1 because path only has a size of 2 and since index 1 corresponds to the intermediary token, you can just reference the same number again to get the appropriate value for amountsOut.