Fraxlend (Frax Finance) contest - mics's results

Table Of Content

• QA REPORT * Different solidity versions are in use * Missing 0 address check at transfer * Loss of precision: multiplications should be before divisions * SPDX license not provided in source file * validate fee parameter * Should approve(0) first * Loss of precision by using division over possible multiplication * Array access is out of bounds * Avoid floating pragma * Events not emitted for important state changes * Add event to the following functions * Consider removing the unused parameters names in the following functions * Not indexed events * Several functions are declaring named returns but then are using return statements. I suggest choosing only one for readability reasons. * Some of the following function specification is missing

QA REPORT

Different solidity versions are in use

The project is compiled with different versions of solidity, which is not recommended because it can lead to undefined behaviors.

Missing 0 address check at transfer

Some contracts does not support 0 transfer, then the transaction will revert with no explanation. We recommend to add a require statement that the amount is not 0.

Code Instances:

• FraxlendPair.sol#L246
• FraxlendPairCore.sol#L573
• FraxlendPair.sol#L251
• FraxlendPairCore.sol#L776
• FraxlendPair.sol#L242

Loss of precision: multiplications should be before divisions

Consider changing the order of the following instances math operators such that multiplications comes before divisions to improve calculation precision with no cost.

Code Instances:

• FraxlendPairCore.sol#L313
• BorrowPairTest.t.sol#L155
• LiquidationPairTest.sol#L21
• BorrowPairTest.t.sol#L19
• LiquidationPairTest.sol#L52

SPDX license not provided in source file

Before publishing, consider adding a comment containing 'SPDX-License-Identifier: MIT' at the beginning of each source file.

Code Instances:

• FraxlendPairConstants.sol
• LinearInterestRate.sol
• BasePairTest.sol
• VariableInterestRate.sol
• VariableRateTest.sol

validate fee parameter

The fee parameter should be validated to be strictly greater than 0 and less than 100%. In the following lines at least one of those checks is missing.

Code Instances:

• FraxlendPair.sol#L68
• BorrowPairTest.t.sol#L74
• BasePairTest.sol#L285
• FraxlendPairCore.sol#L160
• FraxlendPairDeployer.sol#L201

Should approve(0) first

Some tokens (like USDT L199) do not work when changing the allowance from an existing non-zero allowance value. They must first be approved by zero and then the actual allowance must be approved.

Code Instances:

• FraxlendPairCore.sol#L264
• BasePairTest.sol#L491
• LiquidationPairTest.sol#L64
• BasePairTest.sol#L287
• LendPairTest.t.sol#L80

Loss of precision by using division over possible multiplication

In cases of computing a / b < c you could improve precision by doing instead a < c * b.

Code Instances:

• BasePairTest.sol#L384
• BasePairTest.sol#L361
• BasePairTest.sol#L407
• BasePairTest.sol#L338

Array access is out of bounds

There is no check for the access to be in the array bounds.

Code Instances:

• FraxlendPairCore.sol#L1162
• FraxlendPairCore.sol#L1076

Avoid floating pragma

Contracts should be deployed with the same compiler version and flags that they have been tested with thoroughly. Locking the pragma helps to ensure that contracts do not accidentally get deployed using, for example, an outdated compiler version that might introduce bugs that affect the contract system negatively. (SWC-103)

Code Instances:

• FraxlendPairHelper.sol
• LinearRateTest.sol
• FraxlendPairDeployerTest.sol
• BasePairTest.sol
• FraxlendWhitelist.sol

Events not emitted for important state changes

When changing state variables events are not emitted. Emitting events allows monitoring activities with off-chain monitoring tools.

Code Instances:

• FraxlendPairCore.sol#L882
• FraxlendPairCore.sol#L664
• FraxlendPairDeployer.sol#L103
• FraxlendPairDeployer.sol#L122
• FraxlendPairDeployer.sol#L170

Add event to the following functions

Code Instances:

• BasePairTest.sol#L190
• FraxlendPairCore.sol#L609
• FraxlendPairCore.sol#L160
• FraxlendPairCore.sol#L590
• FraxlendPairCore.sol#L882

Consider removing the unused parameters names in the following functions

Code Instances:

• VariableInterestRate.sol#L57
• VariableInterestRate.sol#L63
• FraxlendPair.sol#L68

Not indexed events

The emitted event is not indexed, making off-chain scripts such as front-ends of dApps difficult to filter the events efficiently.

Code Instances:

• FraxlendPair.sol#L211
• FraxlendPairCore.sol#L376
• FraxlendPair.sol#L200
• FraxlendPair.sol#L268
• FraxlendPairCore.sol#L389

Several functions are declaring named returns but then are using return statements. I suggest choosing only one for readability reasons.

Using both named returns and a return statement isn't necessary. Removing one of those can improve code clarity.

Code Instances:

• LinearInterestRate.sol#L46
• VariableInterestRate.sol#L52
• FraxlendPairDeployer.sol#L201
• FraxlendPairCore.sol#L417
• BasePairTest.sol#L173

Some of the following function specification is missing

Code Instances:

• FraxlendPair.sol#L128
• BasePairTest.sol#L125
• VariableInterestRate.sol#L57
• FraxlendPair.sol#L78
• FraxlendPair.sol#L288

Table Of Content

• GAS REPORT * Using abiEncodePacked() is more efficient that abiEncode() * Don't cache msg.sender * Use bytes32 instead string whenever possible * Use assembly opcodes iszero instead of solidity equation to save gas * If the function is onlyOwner you may make it payable to reduce gas usage. * Use custom errors

GAS REPORT

Using abiEncodePacked() is more efficient that abiEncode()

Code Instances:

• FraxlendPairCore.sol#L449
• FraxlendPairDeployerTest.sol#L231
• FraxlendPairDeployer.sol#L327
• LinearRateTest.sol#L76
• VariableInterestRate.sol#L52

Don't cache msg.sender

reading msg.sender is 2 gas units which is less than a read of a local var + the unnecessary store operation.

Code Instances:

• FraxlendPairCore.sol#L668
• FraxlendPairDeployer.sol#L225
• BorrowPairTest.t.sol#L123
• Scenarios.sol#L63
• LendPairTest.t.sol#L17

Use bytes32 instead string whenever possible

For instance, FraxlendPairDeployer.sol#L314

Use assembly opcodes iszero instead of solidity equation to save gas

Code Instances:

• BasePairTest.sol#L334
• LendPairTest.t.sol#L24
• BasePairTest.sol#L357
• FraxlendPairCore.sol#L307
• BasePairTest.sol#L403

If the function is onlyOwner you may make it payable to reduce gas usage.

Code Instances:

• FraxlendPair.sol#L204
• FraxlendWhitelist.sol#L65
• FraxlendPair.sol#L274
• FraxlendPair.sol#L234
• FraxlendWhitelist.sol#L50

Use custom errors

In the following require statements you can use custom errors to save gas and improve code quality.

Code Instances:

• LinearInterestRate.sol#L64
• FraxlendPairDeployer.sol#L204
• FraxlendPairDeployer.sol#L364
• FraxlendPairDeployer.sol#L365
• FraxlendPairDeployer.sol#L227