Platform: Code4rena
Start Date: 06/01/2023
Pot Size: $210,500 USDC
Total HM: 27
Participants: 73
Period: 14 days
Judge: 0xean
Total Solo HM: 18
Id: 203
League: ETH
Rank: 49/73
Findings: 1
Award: $121.59
🌟 Selected for report: 0
🚀 Solo Findings: 0
🌟 Selected for report: CodingNameKiki
Also found by: 0xA5DF, 0xAgro, 0xNazgul, 0xSmartContract, Aymen0909, BRONZEDISC, Bnke0x0, Breeje, Cyfrin, GalloDaSballo, HollaDieWaldfee, IceBear, IllIllI, MyFDsYours, RaymondFam, Ruhum, SaharDevep, Sathish9098, Soosh, Udsen, __141345__, brgltd, btk, carlitox477, chaduke, chrisdior4, cryptonue, delfin454000, descharre, hihen, joestakey, ladboy233, lukris02, luxartvinsec, peanuts, pedr02b2, rotcivegaf, shark, tnevler, yongskiws
121.587 USDC - $121.59
Context:
return true;
L176return _price(false);
L317return _price(true);
L326return (issueQueues[account].left, issueQueues[account].right);
L635return (false, req);
L50return (true, req);
L72return super.propose(targets, values, calldatas, description);
L92return (
L105return
L220return
L239return auction.encodedClearingOrder;
L111return auction.encodedClearingOrder;
L123return super.price();
L52Recommendation:
Choose named return variable or return statement. It is unnecessary to use both.
Context:
bytes32 private constant _PERMIT_TYPEHASH =
L126bytes32 private constant _DELEGATE_TYPEHASH =
L27bytes32 constant UIntOutofBoundsHash = keccak256(abi.encodeWithSignature("UIntOutOfBounds()"));
L33bytes32 public constant METADEPOSIT_TYPEHASH =
L49bytes32 public constant METAWITHDRAWAL_TYPEHASH =
L53Description:
According to official solidity documentation for a constant variable, the expression assigned to it is copied to all the places where it is accessed and also re-evaluated each time. It is recommended to use immutable instead.
Context:
require(share.rsrDist <= 10000, "RSR distribution too high");
L165require(share.rTokenDist <= 10000, "RToken distribution too high");
L166Description:
Scientific notation should be used for better code readability.
Context:
tradingDelay = val;
L259backingBuffer = val;
L266auctionLength = newAuctionLength;
L139period = period_;
L91ratio = ratio_;
L100basketsNeeded = basketsNeeded_;
L583issuanceRate = val;
L592battery.scalingRedemptionRate = val;
L605name = name_;
L804symbol = symbol_;
L808shortFreeze = shortFreeze_;
L183longFreeze = longFreeze_;
L190Recommendation:
Example how to fix require(_newOwner != owner, " Same address");
Context:
function register(IAsset asset) external governance returns (bool) {
L61 (external function can not go after public function)function setTradingDelay(uint48 val) public governance {
L256 (public function can not go after private function)function setDisabled(bool disabled_) external governance {
L143 (external function can not go after public function)struct Transfer {
L67 (struct definition can not go after external function)uint256[47] private __gap;
L108 (state variable can not go after public function)function poke() external {
L43 (external function can not go after public function)function currentEra() external view returns (uint256) {
L55 (external function can not go after internal )uint64 constant FIX_HALF = uint64(FIX_SCALE) / 2;
L310 (state variable declaration can not go after internal function)struct Pending {
L43 (struct definition can not go after external function)event StRSRSet(IStRSR indexed oldVal, IStRSR indexed newVal);
L108 (event definition can not go after external function)event MainInitialized();
L154 (event definition can not go after external function)function grantRole(bytes32 role, address account)
L89 (public function can not go after internal function)IRToken public rToken;
L34 (state variable declaration can not go after internal function)modifier notPausedOrFrozen() {
L41 (modifier definition can not go after internal function)struct BasketRange {
L116 (struct definition can not go after external function)function settleTrade(IERC20 sell) external notPausedOrFrozen nonReentrant {
L66 (external function can not go after internal function)modifier nonReentrant() {
L49 (modifier definition can not go after constructor)function lotPrice() external view virtual returns (uint192 lotLow, uint192 lotHigh) {
L126 (external function can not go after public function)function claimRewards() external virtual override {
L52 (external function can not go after public function)function claimRewards() external virtual override {
L55 (external function can not go after public function)function lotPrice() external view returns (uint192 lotLow, uint192 lotHigh) {
L87 (external function can not go after public function)function rate() external view returns (uint256) {
L54 (external function can not go after public function)function exchangeRateCurrent() external returns (uint256) {
L27 (external function can not go after public function)function getRoundData(uint80 _roundId)
L71 (external function can not go after public function)function setSimplyRevert(bool on) external {
L27 (external function can not go after public function)Description:
According to official solidity documentation functions should be grouped according to their visibility and ordered:
constructor
receive function (if exists)
fallback function (if exists)
external
public
internal
private
Within a grouping, place the view and pure functions last.
Recommendation:
Put the functions in the correct order according to the documentation.
Context:
/// Mointain the overall backing policy; handout assets otherwise
L89 (Change Mointain to Maintain)// (trades[addr] == true) iff this contract has created an ITrade clone at addr
L47 (Change iff to if)// lastPayoutBal' = rToken.balanceOf'(this) (balance now == at end of pay leriod)
L66 (Change leriod to period)// queue.right == left iff there are no more pending issuances in this queue
L106 (Change iff to if)// issuances, and so any particular issuance is actually the _difference_ between two adjaacent
L109 (Change adjaacent to adjacent)// The way to keep an IssueQueue striaght in your head is to think of each TotalIssue item as a
L112 (Change striaght to straight)// We define a (partial) ordering on IssueItems: item1 < item2 iff the following all hold:
L124 (Change iff to if)* If this happens, users balances are zereod out and StRSR is re-issued at a 1:1 exchange rate
L25 (Change zereod to zeroed)// r'.queue is r.queue with a new entry appeneded for (totalDrafts' - totalDraft) drafts
L541 (Change appeneded to appended)/// Overriden in StRSRVotes to handle rebases
L570 (Change Overriden to Overridden)// _delegates[account] is the address of the delegate that `accountt` has specified
L30 (Change accountt to account)// Every function should revert iff its result is out of bounds.
L21 (Change iff to if)bytes32 constant UIntOutofBoundsHash = keccak256(abi.encodeWithSignature("UIntOutOfBounds()"));
L33 (Change UIntOutofBoundsHash to UIntOutOfBoundsHash)/// @return backing The worst-case collaterazation % the protocol will have after done trading
L100 (Change collaterazation to collateralization???)* @notice A UX-friendly layer for interactin with the protocol
L68 (Change interactin to interaction)/// That is, id was cancelled iff firstId <= id < endId
L47 (Change iff to if)/// @param redeemer The address of the account redeeeming RTokens
L74 (Change redeeeming to redeeming)/// Set the fraction of the RToken supply that can be reedemed at once
L178 (Change reedemed to redeemed)/// Emitted whenever RSR are paids out
L71 (Change paids to paid)* Typically freezing thaws on its own in a predetemined number of blocks.
L22 (Change predetemined to predetermined)// trades[sell] != 0 iff trade[sell] has been opened and not yet settled
L37 (Change iff to if)* @return The amound of pending rewards in RAY
L524 (Change amound to amount)function setFeeParameters(uint256 newFeeNumerator, address newfeeReceiverAddress)
L127 (Change newfeeReceiverAddress to newFeeReceiverAddress)// @dev: function to intiate a new auction
L137 (Change intiate** to initiate)"limit price not better than mimimal offer"
L281 (Change mimimal to minimal)/// A Gnosis Mock that attemts to reenter on initiateAuction
L10 (Change attemts to attempts)function openTrade(TradeRequest memory req) external view notPausedOrFrozen returns (ITrade) {
L38 (external function can not go after public function)bytes memory returndata = address(token).functionCall(
L198 (Change returndata to returnData)(bool success, bytes memory returndata) = target.call{ value: value }(data);
L797 (Change returndata to returnData)(bool success, bytes memory returndata) = target.staticcall(data);
L829 (Change returndata to returnData)bytes memory returndata,
L835 (Change returndata to returnData)// from this trade's acution will all eventually go to origin.
L47 (Change acution to auction)buy
and sell
at this address to `origin```` L166 (Change balancess to balances)Context:
* @dev Claims reward for an user on behalf, on all the assets of the lending pool, accumulating the pending rewards. The caller must
L90"Withdraw(address owner,address recipient,uint256 staticAmount,uint256 dynamicAmount,bool toUnderlying,uint256 nonce,uint256 deadline)"
L55* @notice Compute the pending in RAY (rounded down). Pending is the amount to add (not yet unclaimed) rewards in RAY (rounded down).
L520* Logic was copied and modified from here: https://github.com/OpenZeppelin/openzeppelin-contracts/blob/master/contracts/utils/SafeCast.sol
L653Description:
Maximum suggested line length is 120 characters.
#0 - c4-judge
2023-01-25T00:13:35Z
0xean marked the issue as grade-b