Phuture Finance contest - minhquanym's results

1. ManagedIndex can be initialize with totalWeight not equal to MAX_WEIGHT

Impact

• Function ManagedIndex.initialize() not check if sum of weights is equal MAX_WEIGHT
• This can lead to some problems:
  • mint share accounting will not correct since it assumes totalWeight = MAX_WEIGHT https://github.com/code-423n4/2022-04-phuture/blob/594459d0865fb6603ba388b53f3f01648f5bb6fb/contracts/IndexLogic.sol#L50
  • Cannot reweight correctly. Because reweight also assumes totalWeight = MAX_WEIGHT to do calculation https://github.com/code-423n4/2022-04-phuture/blob/594459d0865fb6603ba388b53f3f01648f5bb6fb/contracts/IndexLogic.sol#L50

Proof of concept

• https://github.com/code-423n4/2022-04-phuture/blob/594459d0865fb6603ba388b53f3f01648f5bb6fb/contracts/ManagedIndex.sol#L27-L39
• For example, create index with input params _weights = [1, 1]

Recommended Mitigation Steps

Check for sum of _weights[] equal to MAX_WEIGHT

2. Should add Router to help users mint and burn index token

Impact

• In mint and burn function, contract assumes users had already deposit required tokens.
• But if users transfer tokens in another transaction before mint, anyone can front-run and call mint to claim that minted index token.
• Besides that, users cannot figure out exactly how many tokens they should transfer in, and can loss the left over if the amounts transferred in is not weighted correctly.

Proof of concept

• https://github.com/code-423n4/2022-04-phuture/blob/594459d0865fb6603ba388b53f3f01648f5bb6fb/contracts/IndexLogic.sol#L48
• https://github.com/code-423n4/2022-04-phuture/blob/594459d0865fb6603ba388b53f3f01648f5bb6fb/contracts/IndexLogic.sol#L51-L52

Recommended Mitigation Steps

• Add Router contract to help users transfer token in, call mint and burn all in one transaction.

1. Cache assets.at(i) and inactiveAssets.at(i) can save gas

Details

• In IndexLogic, each time assets.at(i) is called, at least 1 storage read operation (100 gas). Should cache it to memory variables to save gas.
• Similarly in reweight function of ManagedIndexReweightingLogic, TrackedIndexReweightingLogic, TopNMarketCapReweightingLogic

Occurences

• https://github.com/code-423n4/2022-04-phuture/blob/594459d0865fb6603ba388b53f3f01648f5bb6fb/contracts/IndexLogic.sol#L31-L92 Line 40, 41, 44, 47, 48, 49, 61, 63, 67
• https://github.com/code-423n4/2022-04-phuture/blob/594459d0865fb6603ba388b53f3f01648f5bb6fb/contracts/ManagedIndexReweightingLogic.sol#L38-L43 Line 39, 40
• https://github.com/code-423n4/2022-04-phuture/blob/594459d0865fb6603ba388b53f3f01648f5bb6fb/contracts/TopNMarketCapReweightingLogic.sol#L37-L42

Recommended Mitigation Steps

Cache assets.at(i), for example

address asset = assets.at(i);