Platform: Code4rena
Start Date: 09/12/2021
End Date: 12/12/2021
Period: 4 days
Status: Completed
Reporters: itsmetechjay, CloudEllie
Pot Size: $25,000 USDC
Participants: 25
Reporters: itsmetechjay, CloudEllie
Judge: LSDan
Id: 64
League: ETH
WatchPug | 1/25 | $4,242.68 | 6 | 3 | 1 | 1 | 0 | - | - | 0 |
leastwood | 2/25 | $2,155.15 | 6 | 3 | 0 | 2 | 1 | 0 | - | 0 |
harleythedog | 3/25 | $2,016.68 | 6 | 4 | 0 | 1 | 1 | - | 0 | 0 |
defsec | 4/25 | $1,104.15 | 3 | 2 | 0 | 0 | 0 | 0 | - | 0 |
kenzo | 5/25 | $1,071.87 | 6 | 4 | 0 | 1 | 0 | - | 0 | 0 |
certora | 6/25 | $1,067.54 | 4 | 1 | 0 | 1 | 0 | - | - | 0 |
sirhashalot | 7/25 | $1,005.40 | 3 | 1 | 0 | 1 | 1 | 0 | - | 0 |
csanuragjain | 8/25 | $895.50 | 4 | 3 | 0 | 0 | 0 | - | 0 | 0 |
0x0x0x | 9/25 | $867.30 | 4 | 1 | 0 | 1 | 0 | - | - | 0 |
pauliax | 10/25 | $799.95 | 4 | 2 | 0 | 0 | 0 | - | - | 0 |
Auditor per page
The focus of this contest is the TWAB Reward contract that will distribute rewards to depositors in the PoolTogether V4 prize pools.
Compared to a traditional staking contract where users need to deposit tokens in order to receive rewards, PoolTogether users will only need to hold V4 prize pool tickets in order to be eligible to claim rewards.
This is made possible thanks to the TWAB (Time-Weighted Average Balance) concept introduced in V4. For an overview of V4, wardens can consult the V4 Documentation.
Wardens should focus on this mechanism and search for mathematical or logic errors that would allow a malicious actor to claim more rewards than they are eligible for.
This contract also supports the creation of several promotions, otherwise known as rewards campaigns. Promotions run simultaneously and distribute different types of ERC20 tokens. A promotion runs for several epochs of a fixed time duration.
Rewards are calculated based on the average amount of tickets a user holds during the epoch duration. A user should only be able to claim rewards from epochs that are already over and he should only be able to claim these once.
Representatives from PoolTogether will be available in the Code4rena Discord to answer any questions during the contest period.
| Contract | Source Lines of Code | External Calls | Libraries |
|---|---|---|---|
| ITwabRewards.sol | ~121 | None | OpenZeppelin IERC20 |
| TwabRewards.sol | ~378 | Ticket <br/> ERC20 token | OpenZeppelin SafeERC20 |