Platform: Code4rena
Start Date: 11/05/2022
Pot Size: $150,000 USDC
Total HM: 23
Participants: 93
Period: 14 days
Judge: LSDan
Total Solo HM: 18
Id: 123
League: ETH
Rank: 67/93
Findings: 1
Award: $151.97
🌟 Selected for report: 0
🚀 Solo Findings: 0
🌟 Selected for report: IllIllI
Also found by: 0x1f8b, 0x4non, 0xNazgul, 0xNineDec, 0xf15ers, 0xkatana, 242, AlleyCat, BouSalman, BowTiedWardens, CertoraInc, Chom, Cityscape, FSchmoede, Funen, GimelSec, Hawkeye, JC, JDeryl, Kaiziron, Kthere, Kumpa, MaratCerby, MiloTruck, Nethermind, NoamYakov, PPrieditis, QuantumBrief, Rolezn, Ruhum, SmartSek, SooYa, Tadashi, TerrierLover, WatchPug, Waze, _Adam, asutorufos, berndartmueller, bobirichman, c3phas, catchup, cccz, ch13fd357r0y3r, cryptphi, csanuragjain, cthulhu_cult, defsec, delfin454000, ellahi, fatherOfBlocks, hansfriese, hubble, hyh, jayjonah8, joestakey, kenta, kenzo, kirk-baird, mics, oyc_109, p_crypt0, reassor, robee, sach1r0, samruna, sashik_eth, sikorico, simon135, sorrynotsorry, sseefried, tintin, unforgiven, z3s, zmj
151.9654 USDC - $151.97
Floating Pragma used in Aura.sol, AuraBalRewardPool.sol, AuraClaimZap.sol, AuraMath.sol, AuraMerkleDrop.sol, AuraMinter.sol, AuraPenaltyForwarder.sol, AuraStakingProxy.sol, AuraVestedEscrow.sol, BalLiquidityProvider.sol, ClaimFeesHelper.sol, ExtraRewardsDistributor.sol. Contracts should be deployed with the same compiler version and flags that they have been tested with thoroughly. Locking the pragma (i.e. by not using ^) helps to ensure that contracts do not accidentally get deployed using, for example, an outdated compiler version that might introduce bugs that affect the contract system negatively.
Reference
The whole project have different solidity compiler ranges ( 0.6.12 - 0.8.11) referenced. This leads to potential security flaws between deployed contracts depending on the compiler version chosen for any particular file. It also greatly increases the cost of maintenance as different compiler versions have different semantics and behavior.
The project uses Solidity version 0.6.12. Using an old version prevents access to new Solidity security checks. However the current version is 0.8.14 with more benefits and less bugs.
The project uses deprecated safeApprove in AuraBalRewardPool.sol, AuraClaimZap.sol, AuraLocker.sol, AuraMerkleDrop.sol, AuraPenaltyForwarder.sol, AuraStakingProxy.sol, AuraVestedEscrow.sol, BalLiquidityProvider.sol, CrvDepositorWrapper.sol, BaseRewardPool4626.sol, Booster.sol, CrvDepositor.sol, VoterProxy.sol Link
transfer and safeTransfer methods are used inside the codebase. Since these methods use 2300 gas stipend which is not adjustable, it may likely to get broken when calling a contract's fallback function.
Reference Link -1, Reference Link -2
The distributeOther() function can be re-entered by fake tokens or tokens with callbacks. Reference