Kuiper contest - loop's results

Handle

loop

Vulnerability details

The initialize function in Basket has no safeguard for getting invoked again after Basket has been initialized from Factory.

Impact

State variables of the basket can be overwritten.

Proof of Concept

The inititalize function sets most of the state variables: `function initialize(IFactory.Proposal memory proposal, IAuction auction_) public override { publisher = proposal.proposer; licenseFee = proposal.licenseFee; factory = IFactory(msg.sender); auction = auction_; ibRatio = BASE; tokens = proposal.tokens; weights = proposal.weights; approveUnderlying(address(auction));

    __ERC20_init(proposal.tokenName, proposal.tokenSymbol);

}` Creating a contract using IFactory a custom proposal can be passed to the initialize function overwriting the state variables of the Basket contract.

Recommended Mitigation Steps

Use initialized boolean similar to initialize function in Auction: function initialize(address basket_, address factory_) public override { require(!initialized); basket = IBasket(basket_); factory = IFactory(factory_); initialized = true; }

Handle

loop

Vulnerability details

Variables smaller than 32 bytes can be grouped together in the same storage slot. The globally declared booleans auctionOngoing, hasBonded and initialized in Auction.sol can be packed together in the same slot considering booleans have a size of 1 byte. Currently they are split by uint256 variables and each take up a full storage slot.

Impact

Packing variables saves a bit of gas due to less storage slots used.

Proof of Concept

Auction.sol : line 16-21:

bool public override auctionOngoing; - slot 1 uint256 public override auctionStart; - slot 2 bool public override hasBonded; - slot 3 uint256 public override bondAmount; - slot 4 uint256 public override bondTimestamp; - slot 5 bool public override initialized; - slot 6

Could be changed into:

bool public override auctionOngoing; - slot 1 bool public override initialized; - slot 1 bool public override hasBonded; - slot 1 uint256 public override auctionStart; - slot 2 uint256 public override bondAmount; - slot 3 uint256 public override bondTimestamp; - slot 4