Badger-Vested-Aura contest - rfa's results

Lines of code

https://github.com/Badger-Finance/vested-aura/blob/v0.0.2/contracts/MyStrategy.sol#L223

Vulnerability details

Impact

In the LOCKER contract https://etherscan.io/address/0x3Fa73f1E5d8A792C80F426fc8F84FBF7Ce9bBCAC#code anyone can call getreward() for any account, therefore an attacker can frontrun an authorized actor, by calling getreward(address(myStrategy)), before the harvest() call by an authorized actor get executed, this will lead to https://github.com/Badger-Finance/vested-aura/blob/v0.0.2/contracts/MyStrategy.sol#L228 aurabalEarned value to 0, since the before and after balance is the same, and this AURABAL token cannot get sweeped due to the _onlyNotProtectedTokens() preventing this token to get sweep, making the AURABAL token stuck and not claimable

Proof of Concept

https://github.com/Badger-Finance/vested-aura/blob/v0.0.2/contracts/MyStrategy.sol#L223

gas

Title: Declaring var in the returns()

https://github.com/Badger-Finance/vested-aura/blob/v0.0.2/contracts/MyStrategy.sol#L161-L166

Remove L162 and declare protectedTokens inside the returns can save gas Change to:

    function getProtectedTokens() public view virtual override returns (address[2] memory protectedTokens) { // @audit-info: declare here
        protectedTokens[0] = want; // AURA
        protectedTokens[1] = address(AURABAL);
    }

It can save 178 gas per call

Title: Using && inside require()

https://github.com/Badger-Finance/vested-aura/blob/v0.0.2/contracts/MyStrategy.sol#L184-L187

Instead of using && to validate, using multiple require can save 15 execution gas fee per call (although it will cost more in deployment gas fee). Change to:

        require(
            balanceOfPool() == 0,
            "You have to wait for unlock or have to manually rebalance out of it"
        );
        require(
            LOCKER.balanceOf(address(this)) == 0,
            "You have to wait for unlock or have to manually rebalance out of it"
        );

Title: using < 32 bytes string to revert

https://github.com/Badger-Finance/vested-aura/blob/v0.0.2/contracts/MyStrategy.sol#L186

Strings are broken into 32 byte chunks for operations. Revert error strings over 32 bytes therefore consume extra gas than shorter strings

Title: