Phuture Finance contest - kenta's results

Lines of code

https://github.com/code-423n4/2022-04-phuture/blob/main/contracts/ChainlinkPriceOracle.sol#L83-L84

Vulnerability details

Impact

You check only the answer(The price) after calling the chainlink Chainlink Price feeds in the following lines. In addition, you need to check whether the data is really updated.

Proof of Concept

https://github.com/code-423n4/2022-04-phuture/blob/main/contracts/ChainlinkPriceOracle.sol#L83-L84

Tools Used

code review

Recommended Mitigation Steps

Please add the following validations.

(uint80 baseRoundID, int basePrice, ,uint256 baseUpdatedAt , uint80 baseAnsweredInRound ) = baseAggregator.latestRoundData(); (uint80 quoteRoundID, int quotePrice, ,uint256 quoteUpdatedAt , uint80 quoteAnsweredInRound ) = assetInfo.aggregator.latestRoundData();

require(basePrice > 0 && quotePrice > 0, "ChainlinkPriceOracle: NEGATIVE"); require(baseAnsweredInRound >= baseRoundID && quoteAnsweredInRound >= quoteRoundID , "error message"); require(baseUpdatedAt > 0 && quoteUpdatedAt > 0, "error message");

2022-04-phuture

1 missing validation for array lengths in initialize. The length of the input _assets and _capitalizations must be the same.

https://github.com/code-423n4/2022-04-phuture/blob/main/contracts/TrackedIndex.sol#L25-L27

You can add the following require statement.

require(_assets.length == _capitalizations.length, “error message”);

2 Lock pragmas to specific compiler version. Contracts should be deployed with the same compiler version and flags that they have been tested with thoroughly. Locking the pragma helps to ensure that contracts do not accidentally get deployed using, for example, an outdated compiler version that might introduce bugs that affect the contract system negatively.

pragma solidity 0.8.7;

3 missing validation for _amount in transfer.

https://github.com/code-423n4/2022-04-phuture/blob/main/contracts/libraries/NAV.sol#L22

require(_amount != 0, “error message”);

2022-04-phuture gas optimization

1 use != 0 instead of > 0. != is cheaper than > 0.

https://github.com/code-423n4/2022-04-phuture/blob/main/contracts/libraries/NAV.sol#L49 https://github.com/code-423n4/2022-04-phuture/blob/main/contracts/ManagedIndexReweightingLogic.sol#L61 https://github.com/code-423n4/2022-04-phuture/blob/main/contracts/ManagedIndexReweightingLogic.sol#L98 https://github.com/code-423n4/2022-04-phuture/blob/main/contracts/PhutureIndex.sol#L56 https://github.com/code-423n4/2022-04-phuture/blob/main/contracts/PhutureIndex.sol#L64

if (i != 0) {} if (newWeight != 0) { if (shares != 0) {}

2 missing input validation for _balance in burn. If _balance is 0, the amount will be always 0. You have validation for the amount. However, if you have validation for _balance, you can avoid unnecessary execution.

https://github.com/code-423n4/2022-04-phuture/blob/main/contracts/libraries/NAV.sol#L56

require(_balance != 0, “error message”);

3 use unchecked for the following calculation. The underflow is already checked in if sentence, so you can use the unchecked to save gas costs.

https://github.com/code-423n4/2022-04-phuture/blob/main/contracts/TrackedIndex.sol#L50-L52

if (totalWeight < IndexLibrary.MAX_WEIGHT) { unchecked { weightOf[maxCapitalizationAsset] += IndexLibrary.MAX_WEIGHT - totalWeight; } }

4 use cache for weightOf[maxCapitalizationAsset] in initialize. weightOf[maxCapitalizationAsset] will be called in event too. You can save gas costs by using cache.

https://github.com/code-423n4/2022-04-phuture/blob/main/contracts/TrackedIndex.sol#L50-L53

uint8 _weigtOf = IndexLibrary.MAX_WEIGHT - totalWeight; if (totalWeight < IndexLibrary.MAX_WEIGHT) { weightOf[maxCapitalizationAsset] += _weightOf; } emit UpdateAnatomy(maxCapitalizationAsset, _weightOf);