QA Report

[code423n4]

Summary

We list 1 low-critical finding and 1 non-critical finding:

• (Low) floating pragma
• (Non) duplicate interface staker

(Low) floating pragma

Impact

Floating pragma may cause unexpected compilation time behaviour and introduce unintended bugs.

Proof of Concept

contracts/AuraPenaltyForwarder.sol:2:pragma solidity ^0.8.11;
contracts/AuraStakingProxy.sol:2:pragma solidity ^0.8.11;
contracts/BalLiquidityProvider.sol:2:pragma solidity ^0.8.11;
contracts/AuraVestedEscrow.sol:2:pragma solidity ^0.8.11;
contracts/ExtraRewardsDistributor.sol:2:pragma solidity ^0.8.11;
contracts/AuraMath.sol:2:pragma solidity ^0.8.11;
contracts/AuraLocker.sol:2:pragma solidity ^0.8.11;
contracts/AuraMinter.sol:2:pragma solidity ^0.8.11;
contracts/AuraBalRewardPool.sol:2:pragma solidity ^0.8.11;
contracts/AuraMerkleDrop.sol:2:pragma solidity ^0.8.11;
contracts/AuraClaimZap.sol:2:pragma solidity ^0.8.11;
contracts/ClaimFeesHelper.sol:2:pragma solidity ^0.8.11;
contracts/Aura.sol:2:pragma solidity ^0.8.11;

Recommended Mitigation Steps

Don't use ^, lock pragma to ensure compiler version. e.g. pragma solidity 0.8.11;

(Non) duplicate interface staker

Impact

The IStaker interface is defined duplicately in convex-platform/contracts/contracts/Interfaces.sol and contracts/Aura.sol.

Proof of Concept

https://github.com/code-423n4/2022-05-aura/blob/main/contracts/Aura.sol#L10
https://github.com/code-423n4/2022-05-aura/blob/main/convex-platform/contracts/contracts/Interfaces.sol#L42

Recommended Mitigation Steps

Delete duplicate IStaker interface