Vader Protocol contest - pauliax's results

Handle

pauliax

Vulnerability details

Impact

Consider introducing a reasonable upper limit for vaderPairs length, because it could grow too big to fit in the block limits and there is no way to remove it. This will make functions that iterate over all the pairs fail.

  for (uint256 i; i < totalPairs; ++i)

Recommended Mitigation Steps

There are several possible mitigation steps. You can introduce an upper limit. Or you can add a removal function. Or you can use something like EnumerableSet to store pairs, but this will increase the gas usage: https://github.com/OpenZeppelin/openzeppelin-contracts/blob/master/contracts/utils/structs/EnumerableSet.sol

Handle

pauliax

Vulnerability details

Impact

function mint of USDV skips 24 hour limit check when cycleTimestamp is advanced:

  if (cycleTimestamp <= block.timestamp) {
      cycleTimestamp = block.timestamp + 24 hours;
      cycleMints = uAmount;
  } else {
      cycleMints += uAmount;
      require(
          cycleMints <= dailyLimit,
          "USDV::mint: 24 Hour Limit Reached"
      );
  }

An owner can set any dailyLimit (function setDailyLimit), so there could be a situation when the initial mint on that day is exceeding the limit.

Recommended Mitigation Steps

Proposed solution:

  if (cycleTimestamp <= block.timestamp) {
      cycleTimestamp = block.timestamp + 24 hours;
      cycleMints = uAmount;
  } else {
      cycleMints += uAmount;
  }
  require(
      cycleMints <= dailyLimit,
      "USDV::mint: 24 Hour Limit Reached"
  );

Handle

pauliax

Vulnerability details

Impact

function _addUSDVPair does not check if the foreignAsset does not exist yet, thus it is possible to override it.

Recommended Mitigation Steps

Make sure this is the intended behavior or else add validations, e.g.

  require(pairData.updatePeriod == 0, "...");

Handle

pauliax

Vulnerability details

Impact

Shortening revert strings to fit in 32 bytes will decrease deployment time gas and will decrease runtime gas when the revert condition has been met. Some examples:

    require(
      answeredInRound >= roundID,
      "LBTWAP::getChainlinkPrice: Stale Chainlink Price"
  );
  require(price > 0, "LBTWAP::getChainlinkPrice: Chainlink Malfunction");

Handle

pauliax

Vulnerability details

Impact

2**32 can be pre-calculated and stored in a constant to reduce gas costs:

  uint32 blockTimestamp = uint32(block.timestamp % 2**32);