XDEFI contest - ye0lde's results

Handle

ye0lde

Vulnerability details

Impact

The function below fails to perform input validation on arrays to verify the lengths match. A mismatch could lead to an exception or undefined behavior.

Proof of Concept

multipliers is accessed without validating its length. https://github.com/XDeFi-tech/xdefi-distribution/blob/3856a42df295183b40c6eee89307308f196612fe/contracts/XDEFIDistribution.sol#L83

Tools Used

Visual Studio Code, Remix

Recommended Mitigation Steps

Add input validation to check that the length of multipliers and durations_ match.

Handle

ye0lde

Vulnerability details

Impact

Redundant arithmetic underflow/overflow checks can be avoided when an underflow/overflow cannot happen.

Proof of Concept

The "unchecked" keyword can be applied since there is a require statement to ensure the arithmetic operations would not cause an integer underflow or overflow.

For example here: https://github.com/XDeFi-tech/xdefi-distribution/blob/3856a42df295183b40c6eee89307308f196612fe/contracts/XDEFIDistribution.sol#L114-L120

Change the code to:

        // Throw convenient error if trying to re-lock more than was unlocked. 
        require(lockAmount_ <= amountUnlocked_, "INSUFFICIENT_AMOUNT_UNLOCKED");

        // Handle the lock position creation and get the tokenId of the locked position.
        newTokenId_ = _lock(lockAmount_, duration_, destination_);

        uint256 withdrawAmount;  
        unchecked { withdrawAmount = amountUnlocked_ - lockAmount_; }

A similar change can be made here: https://github.com/XDeFi-tech/xdefi-distribution/blob/3856a42df295183b40c6eee89307308f196612fe/contracts/XDEFIDistribution.sol#L169-L175

Tools Used

Visual Studio Code, Remix

Recommended Mitigation Steps

Add the "unchecked" keyword as shown above.