Platform: Code4rena
Start Date: 28/04/2022
Pot Size: $50,000 USDC
Total HM: 7
Participants: 43
Period: 5 days
Judge: gzeon
Total Solo HM: 2
Id: 115
League: ETH
Rank: 25/43
Findings: 2
Award: $140.08
🌟 Selected for report: 0
🚀 Solo Findings: 0
🌟 Selected for report: Dravee
Also found by: 0x1f8b, 0x4non, 0x52, 0xDjango, AlleyCat, Funen, GalloDaSballo, GimelSec, Hawkeye, MaratCerby, Picodes, berndartmueller, cccz, defsec, delfin454000, dipp, hyh, ilan, joestakey, kebabsec, luduvigo, pauliax, peritoflores, robee, rotcivegaf, samruna, shenwilly, sikorico, simon135, sorrynotsorry, unforgiven, z3s
89.0354 USDC - $89.04
QA https://github.com/code-423n4/2022-04-mimo/blob/main/core/contracts/oracles/BalancerV2LPOracle.sol#L93 https://github.com/code-423n4/2022-04-mimo/blob/main/core/contracts/oracles/GUniLPOracle.sol#L93 Not all the return parameters are used by the caller. Can be removed.
https://github.com/code-423n4/2022-04-mimo/blob/main/core/contracts/inception/AdminInceptionVault.sol#L75 Nested calls to transfer. In depositAndBorrow() function, at line 81, asset is transferred and on next line the allowed amount is increased. However same set of transactions are done as part of _a.core().depositAndBorrow() method. This seems repeatetive and can move more asset than required. Line 81 and 82 can be removed.
https://github.com/code-423n4/2022-04-mimo/blob/main/core/contracts/inception/AdminInceptionVault.sol#L98 Nested calls to transfer. Line 101 does asset.safeTransfer(). Similar transfer is happening in _a.core().withdraw() function. Line 101 is not necessary.
https://github.com/code-423n4/2022-04-mimo/blob/main/core/contracts/inception/AdminInceptionVault.sol#L65 https://github.com/code-423n4/2022-04-mimo/blob/main/core/contracts/inception/AdminInceptionVault.sol#L75 Adding zero check to depositAmount or borrowAmount can avoid gas fees to the caller and make process run faster.
51.0404 USDC - $51.04
https://github.com/code-423n4/2022-04-mimo/blob/main/supervaults/contracts/SuperVaultFactory.sol#L23 If funtion not called from inside the contract, it should be defined as external. For public functions, parameters are stored in memory which can lead to some gas fees.
https://github.com/code-423n4/2022-04-mimo/blob/main/supervaults/contracts/SuperVault.sol#L86 Add zero check to flashloanRepayAmount to save some processing time and gas fees for caller.
https://github.com/code-423n4/2022-04-mimo/blob/main/supervaults/contracts/SuperVault.sol#L312 Add zero check for borrowAmount, this can save gas fees since only called by owner.