Platform: Code4rena
Start Date: 21/10/2021
Pot Size: $80,000 ETH
Total HM: 28
Participants: 15
Period: 7 days
Judge: ghoulsol
Total Solo HM: 19
Id: 42
League: ETH
Rank: 12/15
Findings: 3
Award: $296.51
🌟 Selected for report: 3
🚀 Solo Findings: 0
loop
ERC20 transfer and transferFrom calls normally return true on a succesful transfer. In DutchAuctionLiquidator the call asset.transfer(msg.sender, _collateral); is made. asset refers to whichever ERC20 asset is used for the vault of that auction. If asset is an ERC20 token which does not comply with the EIP-20 standard it might return false on a failed transaction rather than revert. In this case it would count as a valid transaction even though it is not. If a vault would be making use of USDT the transfer call would always revert as USDT returns void on transfers.
There are a few more transfer(From) calls which are unchecked, these are however all on a predetermined asset (mochi, usdM and crv) and unlikely to cause problems.
Unchecked transfer call on asset:
Other unchecked transfer calls (mochi, usdM, crv):
Slither
In other contracts the functions cheapTransfer and cheapTransferFrom are used which are part of the mochifi cheapERC20 library. These functions do check for a return value and could be used rather than transfer and transferFrom.
#0 - r2moon
2021-10-26T15:59:42Z
transferFrom and transfer functions are used for mochi and usdm tokens which are standard EIP-20 tokens.
🌟 Selected for report: loop
Also found by: WatchPug, defsec, gzeon, harleythedog
0.0101 ETH - $41.93
loop
The state variable liquidated is initialized in MochiVault, but the contract never writes a value to it, nor is its value read anywhere.
Takes up a storage slot despite not being used.
loop
In MochiVaultFactory a low level call is made to update the Beacon template to _newTemplate: address(beacon).call(abi.encode(_newTemplate));. Afterwards the _newTemplate is written to the template variable, even if the low level call failed.
Slither
Check if low level call was successful using the boolean return value of a low level call.
#0 - ghoul-sol
2021-11-02T17:14:36Z
I'm not sure why it's marked invalid, the finding seems valid to me.