code-423n4 / 2022-04-badger-citadel-findings

0 stars 1 forks source link

QA Report #148

Closed code423n4 closed 2 years ago

code423n4 commented 2 years ago

1)

StakedCitadelLocker.sol:

Staking proxy does not withdraw funds if shutdown() is called by owner, meaning all tokens frozen and not unstaked. In original cvx code, tokens are withdrawn to proxy address, unstaked and unlocked.

2)

StakedCitadelLocker.sol: transferCVX() function does not update the staking ratio as per the original code.

3) CitadelToken.sol - floating pragmas used, use fixed.

4) GlobalAccessControl.sol - floating pragmas used, use fixed.

5) CitadelMinter.sol:

Line 272, magic numbers used for max_funding_pool_weight. Use a const value rather than magic numbers, for completeness sake.

6) CitadelMinter.sol:

Line 282, seemingly wrong parameter returned in emit. Impact is zero, but aesthetically wrong (?) and perhaps confusing?

Resoultion, emit totalFundingPoolWeight rather than " _newTotalWeight" since the function wants the totalFundingPoolWeight emitted according to comment.