QA Report

[code423n4]

[Low-01] AuraVestedEscrow: FRONT-RUNNABLE fund()

Impact

In AuraVestedEscrow contract, the fund function was missing access controls, allowing any user to fund the contract. By front-running the contract deployers to fund the contract, the incorrect parameters may be supplied, leaving the contract needing to be redeployed.

Proof of Concept

https://github.com/code-423n4/2022-05-aura/blob/4989a2077546a5394e3650bf3c224669a0f7e690/contracts/AuraVestedEscrow.sol#L95-L110

Tools Used

None

Recommended Mitigation Steps

Add the following code to the fund function

require(msg.sender == admin, "!auth");

[Low-02] burn function could burn tokens of any user

Impact

Same as code-423n4/2021-11-overlay-findings#22, the operator could burn any amount of tokens of any user.

Proof of Concept

https://github.com/code-423n4/2022-05-aura/blob/4989a2077546a5394e3650bf3c224669a0f7e690/convex-platform/contracts/contracts/cCrv.sol#L55-L59
https://github.com/code-423n4/2022-05-aura/blob/4989a2077546a5394e3650bf3c224669a0f7e690/convex-platform/contracts/contracts/DepositToken.sol#L53-L57

Tools Used

None

Recommended Mitigation Steps

Update burn function, only the owner can burn his or approved tokens.

[Low-03] must safeapprove 0 first

Impact

The safeApprove() function cannot set a non-zero value to a non-zero value, so before safeApprove a non-zero value, you need to safeApprove 0.

Proof of Concept

https://github.com/code-423n4/2022-05-aura/blob/4989a2077546a5394e3650bf3c224669a0f7e690/contracts/AuraVestedEscrow.sol#L186-L187

Tools Used

None

Recommended Mitigation Steps

Use safeApprove(_spender, 0) to set the allowance to zero immediately before each of the existing safeApprove() calls.

[Low-04] The length of poolInfo needs to be limited

Impact

When the length of poolInfo is too large, the massUpdatePools call may fail due to insufficient gas, which may cause the add and set function calls to fail.

Proof of Concept

https://github.com/code-423n4/2022-05-aura/blob/4989a2077546a5394e3650bf3c224669a0f7e690/convex-platform/contracts/contracts/ConvexMasterChef.sol#L178-L183

Tools Used

None

Recommended Mitigation Steps

Limit the length of poolInfo

[0xMaharishi]

1 & 4 are valid, but duplicates

#174 #305