QA Report

[code423n4]

1. Missing zero address checks

Risk

Low

Impact

Missing checks for zero addresses might lead to loss of funds, failed transactions and can break the protocol functionality.

Proof of Concept

MyStrategy.sol:

• Missing check for newBribesProcessor - https://github.com/Badger-Finance/vested-aura/blob/d504684e4f9b56660a9e6c6dfb839dcebac3c174/contracts/MyStrategy.sol#L98

Tools Used

Manual Review / VSCode

Recommended Mitigation Steps

It is recommended to add zero address checks for listed parameters.

2. Missing events

Risk

Low

Impact

Contract is missing emitting events for critical functions. Lack of events makes it difficult for off-chain applications to monitor the protocol.

Proof of Concept

MyStrategy.sol:

• Missing setWithdrawalSafetyCheck function event - https://github.com/Badger-Finance/vested-aura/blob/d504684e4f9b56660a9e6c6dfb839dcebac3c174/contracts/MyStrategy.sol#L86
• Missing setProcessLocksOnReinvest function event - https://github.com/Badger-Finance/vested-aura/blob/d504684e4f9b56660a9e6c6dfb839dcebac3c174/contracts/MyStrategy.sol#L92
• Missing setBribesProcessor function event - https://github.com/Badger-Finance/vested-aura/blob/d504684e4f9b56660a9e6c6dfb839dcebac3c174/contracts/MyStrategy.sol#L98
• Missing sweepRewardToken function event - https://github.com/Badger-Finance/vested-aura/blob/d504684e4f9b56660a9e6c6dfb839dcebac3c174/contracts/MyStrategy.sol#L107
• Missing _harvest function event - https://github.com/Badger-Finance/vested-aura/blob/d504684e4f9b56660a9e6c6dfb839dcebac3c174/contracts/MyStrategy.sol#L219
• Missing claimBribesFromHiddenHand function event - https://github.com/Badger-Finance/vested-aura/blob/d504684e4f9b56660a9e6c6dfb839dcebac3c174/contracts/MyStrategy.sol#L288
• Missing reinvest function event - https://github.com/Badger-Finance/vested-aura/blob/d504684e4f9b56660a9e6c6dfb839dcebac3c174/contracts/MyStrategy.sol#L353
• Missing manualSendAuraToVault function event - https://github.com/Badger-Finance/vested-aura/blob/d504684e4f9b56660a9e6c6dfb839dcebac3c174/contracts/MyStrategy.sol#L379
• Missing check for _sendBadgerToTree function event - https://github.com/Badger-Finance/vested-aura/blob/d504684e4f9b56660a9e6c6dfb839dcebac3c174/contracts/MyStrategy.sol#L428

Tools Used

Manual Review / VSCode

Recommended Mitigation Steps

It is recommended to add missing events to listed functions.

3. Missing indexing for events

Risk

Non-Critical

Impact

Events should index addresses which helps off-chain applications in monitoring the protocol.

Proof of Concept

MyStrategy.sol:

• Missing indexing for token address - https://github.com/Badger-Finance/vested-aura/blob/d504684e4f9b56660a9e6c6dfb839dcebac3c174/contracts/MyStrategy.sol#L51

Tools Used

Manual Review / VSCode

Recommended Mitigation Steps

It is recommended to add indexing to address type parameters.

4. Deprecated safeApprove

Risk

Non-Critical

Impact

Function safeApprove has been deprecated in favor of safeIncreaseAllowance() and safeDecreaseAllowance().

Proof of Concept

MyStrategy.sol:65:        AURA.safeApprove(address(LOCKER), type(uint256).max);
MyStrategy.sol:67:        AURABAL.safeApprove(address(BALANCER_VAULT), type(uint256).max);
MyStrategy.sol:68:        WETH.safeApprove(address(BALANCER_VAULT), type(uint256).max);

Tools Used

Manual Review / VSCode

Recommended Mitigation Steps

It is recommended to consider using safeIncreaseAllowance() and safeDecreaseAllowance() functions instead of safeApprove.

5. Missing natspec comments

Risk

Non-Critical

Impact

Contract is missing natspec comments which makes code more difficult to read and prone to errors.

Proof of Concept

MyStrategy.sol:

• Missing @param _vault comment - https://github.com/Badger-Finance/vested-aura/blob/d504684e4f9b56660a9e6c6dfb839dcebac3c174/contracts/MyStrategy.sol#L53-L56
• Missing @param delegate comment - https://github.com/Badger-Finance/vested-aura/blob/d504684e4f9b56660a9e6c6dfb839dcebac3c174/contracts/MyStrategy.sol#L78-L79
• Missing @param newWithdrawalSafetyCheck comment - https://github.com/Badger-Finance/vested-aura/blob/d504684e4f9b56660a9e6c6dfb839dcebac3c174/contracts/MyStrategy.sol#L86
• Missing @param newProcessLocksOnReinvest comment - https://github.com/Badger-Finance/vested-aura/blob/d504684e4f9b56660a9e6c6dfb839dcebac3c174/contracts/MyStrategy.sol#L92
• Missing @param newBribesProcessor comment - https://github.com/Badger-Finance/vested-aura/blob/d504684e4f9b56660a9e6c6dfb839dcebac3c174/contracts/MyStrategy.sol#L98
• Missing @param token comment - https://github.com/Badger-Finance/vested-aura/blob/d504684e4f9b56660a9e6c6dfb839dcebac3c174/contracts/MyStrategy.sol#L107
• Missing @param tokens[] comment - https://github.com/Badger-Finance/vested-aura/blob/d504684e4f9b56660a9e6c6dfb839dcebac3c174/contracts/MyStrategy.sol#L116
• Missing @param _amount comment - https://github.com/Badger-Finance/vested-aura/blob/d504684e4f9b56660a9e6c6dfb839dcebac3c174/contracts/MyStrategy.sol#L171
• Missing @return string comment - https://github.com/Badger-Finance/vested-aura/blob/d504684e4f9b56660a9e6c6dfb839dcebac3c174/contracts/MyStrategy.sol#L125-L126
• Missing @return string comment - https://github.com/Badger-Finance/vested-aura/blob/d504684e4f9b56660a9e6c6dfb839dcebac3c174/contracts/MyStrategy.sol#L130-L131
• Missing @return bool comment - https://github.com/Badger-Finance/vested-aura/blob/d504684e4f9b56660a9e6c6dfb839dcebac3c174/contracts/MyStrategy.sol#L135-L136
• Missing @return balance comment - https://github.com/Badger-Finance/vested-aura/blob/d504684e4f9b56660a9e6c6dfb839dcebac3c174/contracts/MyStrategy.sol#L140-L141
• Missing @return rewards[] comment - https://github.com/Badger-Finance/vested-aura/blob/d504684e4f9b56660a9e6c6dfb839dcebac3c174/contracts/MyStrategy.sol#L149
• Missing @return protectedTokens comment - https://github.com/Badger-Finance/vested-aura/blob/d504684e4f9b56660a9e6c6dfb839dcebac3c174/contracts/MyStrategy.sol#L158-L161
• Missing @param _amount, @return _amount comments - https://github.com/Badger-Finance/vested-aura/blob/d504684e4f9b56660a9e6c6dfb839dcebac3c174/contracts/MyStrategy.sol#L192-L194
• Missing @return harvested comment - https://github.com/Badger-Finance/vested-aura/blob/d504684e4f9b56660a9e6c6dfb839dcebac3c174/contracts/MyStrategy.sol#L219
• Missing @param hiddenHandDistributor, _claims comments - https://github.com/Badger-Finance/vested-aura/blob/d504684e4f9b56660a9e6c6dfb839dcebac3c174/contracts/MyStrategy.sol#L288
• Missing @return toDeposit comment - https://github.com/Badger-Finance/vested-aura/blob/d504684e4f9b56660a9e6c6dfb839dcebac3c174/contracts/MyStrategy.sol#L353
• Missing natspec - https://github.com/Badger-Finance/vested-aura/blob/d504684e4f9b56660a9e6c6dfb839dcebac3c174/contracts/MyStrategy.sol#L385
• Missing natspec - https://github.com/Badger-Finance/vested-aura/blob/d504684e4f9b56660a9e6c6dfb839dcebac3c174/contracts/MyStrategy.sol#L396
• Missing natspec - https://github.com/Badger-Finance/vested-aura/blob/d504684e4f9b56660a9e6c6dfb839dcebac3c174/contracts/MyStrategy.sol#L400
• Missing natspec - https://github.com/Badger-Finance/vested-aura/blob/d504684e4f9b56660a9e6c6dfb839dcebac3c174/contracts/MyStrategy.sol#L405
• Missing @param token, @param amount comments - https://github.com/Badger-Finance/vested-aura/blob/d504684e4f9b56660a9e6c6dfb839dcebac3c174/contracts/MyStrategy.sol#L421
• Missing @param amount comment - https://github.com/Badger-Finance/vested-aura/blob/d504684e4f9b56660a9e6c6dfb839dcebac3c174/contracts/MyStrategy.sol#L428

Tools Used

Manual Review / VSCode

Recommended Mitigation Steps

It is recommended to add missing natspec comments.

[GalloDaSballo]

Dup of #52