Timeswap contest - p4st13r4's results

Handle

p4st13r4

Vulnerability details

Impact

TimeswapFactory allows to transfer ownership of the contract, however pendingOwner is never reset upon accepting the ownership. Since it’s a public state var, it’s a good practice to reset it to 0 after the operation

Proof of Concept

function acceptOwner() external override {
    require(msg.sender == pendingOwner, 'E102');
    owner = msg.sender;

    emit AcceptOwner(msg.sender);
}

Tools Used

Editor

Recommended Mitigation Steps

Add

pendingOwner = address(0)

Handle

p4st13r4

Vulnerability details

Impact

In TimeswapConvenience.sol the weth state variable is read twice. It can just be immediately assigned locally so that the two deposit calls avoid reading the same variable from storage

Proof of Concept

• https://github.com/code-423n4/2022-01-timeswap/blob/main/Timeswap/Timeswap-V1-Convenience/contracts/TimeswapConvenience.sol#L505
• https://github.com/code-423n4/2022-01-timeswap/blob/main/Timeswap/Timeswap-V1-Convenience/contracts/TimeswapConvenience.sol#L512

Tools Used

Editor

Recommended Mitigation Steps

Assign weth to localWeth

Handle

p4st13r4

Vulnerability details

Impact

In CollateralizedDebt.sol the pair state variable is read twice. It can just be immediately assigned locally so that the require and the collateralizedDebtCallback do not read the same state variable twice

Proof of Concept

function timeswapPayCallback(uint128 assetIn, bytes calldata data) external override {
    require(msg.sender == address(pair), 'E401');

    convenience.collateralizedDebtCallback(pair, maturity, assetIn, data);
}

Tools Used

Editor

Recommended Mitigation Steps

Assign pair to e.g localPair