Upgrade pragma to at least 0.8.4

[code423n4]

Handle

Dravee

Vulnerability details

Impact

Using newer compiler versions and the optimizer gives gas optimizations
and additional safety checks are available for free.

The advantages of versions 0.8.* over <0.8.0 are:

• Safemath by default from 0.8.0 (can be more gas efficient than
  library based safemath.)
• Low level inliner : from 0.8.2, leads to cheaper runtime gas. Especially relevant when the contract has small functions. For example, OpenZeppelin libraries typically have a lot of small helper functions and if they are not inlined, they cost an additional 20 to 40 gas because of 2 extra jump instructions and additional stack operations needed for function calls.
• Optimizer improvements in packed structs: Before 0.8.3, storing packed structs, in some cases used an
  additional storage read operation. After EIP-2929, if the slot was already cold, this means unnecessary stack operations and extra deploy time costs. However, if the slot was already warm, this means
  additional cost of 100 gas alongside the same unnecessary stack operations and extra deploy time costs.
• Custom errors from 0.8.4, leads to cheaper deploy time cost and run time cost. Note: the run time cost is only relevant when the revert condition is met. In short, replace revert strings by custom errors.

Proof of Concept

The contest repository contracts mainly contain pragma 0.6.11, with some 0.6.12 and a >=0.5.0. The contracts pragma version should be updated to 0.8.4.

Instances include:

./ActivePool.sol:3:pragma solidity 0.6.11;
./BorrowerOperations.sol:3:pragma solidity 0.6.11;
./CollSurplusPool.sol:3:pragma solidity 0.6.11;
./DefaultPool.sol:3:pragma solidity 0.6.11;
./Dependencies/AggregatorV3Interface.sol:4:pragma solidity 0.6.11;
./Dependencies/BaseMath.sol:2:pragma solidity 0.6.11;
./Dependencies/CheckContract.sol:3:pragma solidity 0.6.11;
./Dependencies/LiquityBase.sol:3:pragma solidity 0.6.11;
./Dependencies/LiquityMath.sol:3:pragma solidity 0.6.11;
./Dependencies/LiquitySafeMath128.sol:3:pragma solidity 0.6.11;
./Dependencies/Ownable.sol:3:pragma solidity 0.6.11;
./Dependencies/SafeMath.sol:3:pragma solidity 0.6.11;
./Dependencies/TellorCaller.sol:3:pragma solidity 0.6.11;
./Dependencies/TroveManagerBase.sol:3:pragma solidity 0.6.11;
./Dependencies/Whitelist.sol:3:pragma solidity 0.6.11;
./Dependencies/YetiCustomBase.sol:3:pragma solidity 0.6.11;
./GasPool.sol:3:pragma solidity 0.6.11;
./HintHelpers.sol:3:pragma solidity 0.6.11;
./Interfaces/IActivePool.sol:3:pragma solidity 0.6.11;
./Interfaces/IBaseOracle.sol:3:pragma solidity 0.6.11;
./Interfaces/IBorrowerOperations.sol:3:pragma solidity 0.6.11;
./Interfaces/ICollateralReceiver.sol:3:pragma solidity 0.6.11;
./Interfaces/ICollSurplusPool.sol:3:pragma solidity 0.6.11;
./Interfaces/ICommunityIssuance.sol:3:pragma solidity 0.6.11;
./Interfaces/IDefaultPool.sol:3:pragma solidity 0.6.11;
./Interfaces/IERC20.sol:3:pragma solidity 0.6.11;
./Interfaces/IERC2612.sol:3:pragma solidity 0.6.11;
./Interfaces/IJoeZapper.sol:3:pragma solidity 0.6.11;
./Interfaces/ILiquityBase.sol:3:pragma solidity 0.6.11;
./Interfaces/ILockupContractFactory.sol:3:pragma solidity 0.6.11;
./Interfaces/ILQTYStaking.sol:3:pragma solidity 0.6.11;
./Interfaces/IOracle.sol:3:pragma solidity 0.6.11;
./Interfaces/IPool.sol:3:pragma solidity 0.6.11;
./Interfaces/IPriceCurve.sol:3:pragma solidity 0.6.11;
./Interfaces/IPriceFeed.sol:3:pragma solidity 0.6.11;
./Interfaces/ISortedTroves.sol:3:pragma solidity 0.6.11;
./Interfaces/IStabilityPool.sol:3:pragma solidity 0.6.11;
./Interfaces/ISYETI.sol:3:pragma solidity 0.6.11;
./Interfaces/ITellor.sol:2:pragma solidity 0.6.11;
./Interfaces/ITellorCaller.sol:3:pragma solidity 0.6.11;
./Interfaces/ITraderJoeZap.sol:3:pragma solidity 0.6.11;
./Interfaces/ITroveManager.sol:3:pragma solidity 0.6.11;
./Interfaces/ITroveManagerLiquidations.sol:3:pragma solidity 0.6.11;
./Interfaces/ITroveManagerRedemptions.sol:3:pragma solidity 0.6.11;
./Interfaces/IUniswapV2Pair.sol:3:pragma solidity >=0.5.0;
./Interfaces/IWAsset.sol:3:pragma solidity 0.6.11;
./Interfaces/IWhitelist.sol:3:pragma solidity 0.6.11;
./Interfaces/IYetiRouter.sol:3:pragma solidity 0.6.11;
./Interfaces/IYETIToken.sol:3:pragma solidity 0.6.11;
./Interfaces/IYUSDToken.sol:3:pragma solidity 0.6.11;
./LPRewards/Dependencies/Address.sol:3:pragma solidity 0.6.11;
./LPRewards/Dependencies/SafeERC20.sol:3:pragma solidity 0.6.11;
./LPRewards/Interfaces/ILPTokenWrapper.sol:3:pragma solidity 0.6.11;
./LPRewards/Interfaces/IUnipool.sol:3:pragma solidity 0.6.11;
./LPRewards/Pool2Unipool.sol:3:pragma solidity 0.6.11;
./LPRewards/TestContracts/ERC20Mock.sol:3:pragma solidity 0.6.11;
./LPRewards/Unipool.sol:3:pragma solidity 0.6.11;
./Migrations.sol:3:pragma solidity 0.6.11;
./MultiTroveGetter.sol:3:pragma solidity 0.6.11;
./PriceCurves/ThreePieceWiseLinearPriceCurve.sol:3:pragma solidity 0.6.11;
./PriceFeed.sol:3:pragma solidity 0.6.11;
./SortedTroves.sol:3:pragma solidity 0.6.11;
./StabilityPool.sol:3:pragma solidity 0.6.11;
./TeamAllocation.sol:3:pragma solidity 0.6.11;
./TroveManager.sol:3:pragma solidity 0.6.11;
./TroveManagerLiquidations.sol:3:pragma solidity 0.6.11;
./TroveManagerRedemptions.sol:2:pragma solidity 0.6.11;
./YETI/BoringCrypto/BoringBatchable.sol:2:pragma solidity 0.6.12;
./YETI/BoringCrypto/BoringERC20.sol:2:pragma solidity 0.6.12;
./YETI/BoringCrypto/BoringMath.sol:2:pragma solidity 0.6.12;
./YETI/BoringCrypto/BoringOwnable.sol:2:pragma solidity 0.6.12;
./YETI/BoringCrypto/Domain.sol:5:pragma solidity 0.6.12;
./YETI/BoringCrypto/ERC20.sol:2:pragma solidity 0.6.12;
./YETI/BoringCrypto/IERC20.sol:2:pragma solidity 0.6.12;
./YETI/CommunityIssuance.sol:3:pragma solidity 0.6.11;
./YETI/LockupContract.sol:3:pragma solidity 0.6.11;
./YETI/LockupContractFactory.sol:3:pragma solidity 0.6.11;
./YETI/ShortLockupContract.sol:3:pragma solidity 0.6.11;
./YETI/sYETIToken.sol:2:pragma solidity 0.6.12;
./YETI/TeamLockup.sol:3:pragma solidity 0.6.11;
./YETI/YETIToken.sol:3:pragma solidity 0.6.11;
./YetiFinanceTreasury.sol:3:pragma solidity 0.6.11;
./YUSDToken.sol:3:pragma solidity 0.6.11;

Tools Used

VS Code

Recommended Mitigation Steps

Consider upgrading pragma to at least 0.8.4.

[kingyetifinance]

Duplicate #81