search

code-423n4 / 2022-06-infinity-findings

4 stars 0 forks source link

QA Report #171

Open code423n4 opened 2 years ago

code423n4 commented 2 years ago

Low/QA

Missing Event on Important/State Changes Function

Description

Important or state changes function should emit events upon successful execution for off-chain tracking.

Permalinks

  1. https://github.com/code-423n4/2022-06-infinity/blob/765376fa238bbccd8b1e2e12897c91098c7e5ac6/contracts/core/InfinityExchange.sol#L1220-L1226
  2. https://github.com/code-423n4/2022-06-infinity/blob/765376fa238bbccd8b1e2e12897c91098c7e5ac6/contracts/core/InfinityExchange.sol#L1229-L1232
  3. https://github.com/code-423n4/2022-06-infinity/blob/765376fa238bbccd8b1e2e12897c91098c7e5ac6/contracts/core/InfinityExchange.sol#L1235-L1237
  4. https://github.com/code-423n4/2022-06-infinity/blob/765376fa238bbccd8b1e2e12897c91098c7e5ac6/contracts/core/InfinityExchange.sol#L1240-L1241
  5. https://github.com/code-423n4/2022-06-infinity/blob/765376fa238bbccd8b1e2e12897c91098c7e5ac6/contracts/core/InfinityExchange.sol#L1245-L1246
  6. https://github.com/code-423n4/2022-06-infinity/blob/765376fa238bbccd8b1e2e12897c91098c7e5ac6/contracts/core/InfinityExchange.sol#L1250-L1251
  7. https://github.com/code-423n4/2022-06-infinity/blob/765376fa238bbccd8b1e2e12897c91098c7e5ac6/contracts/core/InfinityExchange.sol#L1255-L1256
  8. https://github.com/code-423n4/2022-06-infinity/blob/765376fa238bbccd8b1e2e12897c91098c7e5ac6/contracts/staking/InfinityStaker.sol#L345-L348
  9. https://github.com/code-423n4/2022-06-infinity/blob/765376fa238bbccd8b1e2e12897c91098c7e5ac6/contracts/staking/InfinityStaker.sol#L351-L361
  10. https://github.com/code-423n4/2022-06-infinity/blob/765376fa238bbccd8b1e2e12897c91098c7e5ac6/contracts/staking/InfinityStaker.sol#L364-L372
  11. https://github.com/code-423n4/2022-06-infinity/blob/765376fa238bbccd8b1e2e12897c91098c7e5ac6/contracts/staking/InfinityStaker.sol#L375-L377

Mitigation

An event of calling critical functions should be generated for security and off-chain monitoring purposes.

Missing Zero-address Validation

Description

NFT transfering function can be called with address zero (0x00...00) as the destination. This might cause unexpected behavior or unintentionally burn.

Permalinks

  1. https://github.com/code-423n4/2022-06-infinity/blob/765376fa238bbccd8b1e2e12897c91098c7e5ac6/contracts/core/InfinityExchange.sol#L371
  2. https://github.com/code-423n4/2022-06-infinity/blob/765376fa238bbccd8b1e2e12897c91098c7e5ac6/contracts/core/InfinityExchange.sol#L1220
  3. https://github.com/code-423n4/2022-06-infinity/blob/765376fa238bbccd8b1e2e12897c91098c7e5ac6/contracts/core/InfinityExchange.sol#L1229
  4. https://github.com/code-423n4/2022-06-infinity/blob/765376fa238bbccd8b1e2e12897c91098c7e5ac6/contracts/core/InfinityExchange.sol#L1235
  5. https://github.com/code-423n4/2022-06-infinity/blob/765376fa238bbccd8b1e2e12897c91098c7e5ac6/contracts/core/InfinityExchange.sol#L1240
  6. https://github.com/code-423n4/2022-06-infinity/blob/765376fa238bbccd8b1e2e12897c91098c7e5ac6/contracts/core/InfinityExchange.sol#L1255
  7. https://github.com/code-423n4/2022-06-infinity/blob/765376fa238bbccd8b1e2e12897c91098c7e5ac6/contracts/staking/InfinityStaker.sol#L375-L377

Mitigation

It is recommended to validate that the destination address should not be address zero to prevent from unintentionally burn.

PROTOCOL_FEE_BPS Can Be Set To 100% or Above

Description

There is no maximum limit on how maximum the PROTOCOL_FEE_BPS can be, which might result in a fee rate at 100%, meaning the protocol will collect the entire trading amount. Additionally, it can be more than 10000 (100%) and will result in Denial of Service due to overflow reverting.

Permalinks

https://github.com/code-423n4/2022-06-infinity/blob/765376fa238bbccd8b1e2e12897c91098c7e5ac6/contracts/core/InfinityExchange.sol#L1266-1269

Mitigation

It is recommended to determine how high the fee can be at maximum and add the validation to ensure that the fee cannot be set higher than the maximum value.

Tautology Require Statement

Description

The reported require statement is validating on tautology logic, the condition that will always be true. From the fact that the default value of uint in Solidity is 0, so, the condition like >= 0 will always be true in any circumstances.

Permalinks

https://github.com/code-423n4/2022-06-infinity/blob/765376fa238bbccd8b1e2e12897c91098c7e5ac6/contracts/staking/InfinityStaker.sol#L193

Mitigation

The condition can be changed from >= 0 to > 0.

Penalty Can Be Zero

Description

The rage-quit penalty can be set to zero which will causing rage quit always be reverted due to divide by zero.

Permalinks

https://github.com/code-423n4/2022-06-infinity/blob/765376fa238bbccd8b1e2e12897c91098c7e5ac6/contracts/staking/InfinityStaker.sol#L364-L372

Mitigation

A zero-value validation check should be included in the penalty setter function.