Papr contest - tnevler's results

NFT Lending Powered by Uniswap v3.

General Information

Platform: Code4rena

Start Date: 16/12/2022

Pot Size: $60,500 USDC

Total HM: 12

Participants: 58

Period: 5 days

Judge: Trust

Total Solo HM: 4

Id: 196

League: ETH

Backed Protocol

Findings Distribution

Researcher Performance

Rank: 36/58

Findings: 1

Award: $43.54

QA:
grade-b

🌟 Selected for report: 0

🚀 Solo Findings: 0

Awards

43.5439 USDC - $43.54

Labels

bug
grade-b
QA (Quality Assurance)
Q-24

External Links

Report

Non-Critical Issues

[N-1]: Function defines a named return variable but then it uses return statements

Context:

return _target; L47

Recommendation:

Choose named return variable or return statement. It is unnecessary to use both.

[N-2]: Variable is unused

Context:

function _auctionCurrentPrice(uint256 id, uint256 startTime, INFTEDA.Auction memory auction) L114 (id)

[N-3]: Wrong order of functions

Context:

function lastUpdated() external view override returns (uint256) { L81 (external function can not go after public function)

Description:

According to official solidity documentation functions should be grouped according to their visibility and ordered:

  • constructor

  • receive function (if exists)

  • fallback function (if exists)

  • external

  • public

  • internal

  • private

Within a grouping, place the view and pure functions last.

Recommendation:

Put the functions in the correct order according to the documentation.

[N-4]: NatSpec is missing

Context:

  1. contract PaprToken is ERC20 { L6 delete
  2. function uniswapV3SwapCallback(int256 amount0Delta, int256 amount1Delta, bytes calldata _data) external { L234
  3. function burnPaprFromAuctionFees(uint256 amount) external override onlyOwner { L386
  4. function _addCollateralToVault(address account, IPaprController.Collateral memory collateral) internal { L413
  5. function _removeCollateral( L424
  6. function _increaseDebt( L456
  7. function _reduceDebt(address account, ERC721 asset, address burnFrom, uint256 amount) internal { L481
  8. function _reduceDebtWithoutBurn(address account, ERC721 asset, uint256 amount) internal { L486
  9. function _increaseDebtAndSell( L493
  10. function _purchaseNFTAndUpdateVaultIfNeeded(Auction calldata auction, uint256 maxPrice, address sendTo) L519
  11. function _handleExcess(uint256 excess, uint256 neededToSaveVault, uint256 debtCached, Auction calldata auction) L532
  12. function _maxDebt(uint256 totalCollateraValue, uint256 cachedTarget) internal view returns (uint256) { L556
  13. library EDAPrice { L7 delete
  14. library OracleLibrary { L8 delete

[N-5]: Typos

Context:

  1. /// @return selector indicating succesful receiving of the NFT L158 (Change succesful to successful)
  2. /// @param auction The defintion of the auction L46 (Change defintion to definition)
  3. /// @dev Derived from the auction. Identitical auctions cannot exist simultaneously L58 (Change Identitical to Identical)
  4. /// @notice if liquidations are currently locked, meaning startLiquidationAuciton will revert L237 (Change startLiquidationAuciton to startLiquidationAuction)

[N-6]: Line is too long

Context:

  1. /// @dev vaults are uniquely identified by the address of the vault owner and the address of the collateral token used in the vault L66
  2. /// @notice removes debt from a vault and burns it by buying it on Uniswap in exchange for the controller's underlying token L164
  3. /// @notice the multiplier for the starting price of an auction, applied to the current price of the collateral in papr tokens L257
  4. /// @notice fee paid by the vault owner when their vault is liquidated if there was excess debt credited to their vault, in bips L260

Description:

Maximum suggested line length is 120 characters.

#0 - c4-judge

2022-12-25T16:22:01Z

trust1995 marked the issue as grade-b

AuditHub

A portfolio for auditors, a security profile for protocols, a hub for web3 security.

Built bymalatrax © 2024

Auditors

Browse

Contests

Browse

Get in touch

ContactTwitter