Hyperware fixes
Cantina Security Report
Organization
- @Hyperware
Engagement Type
Cantina Reviews
Period
-
Researchers
Findings
Medium Risk
1 findings
1 fixed
0 acknowledged
Low Risk
2 findings
2 fixed
0 acknowledged
Gas Optimizations
1 findings
1 fixed
0 acknowledged
Medium Risk1 finding
_delegatedUnlockStamps[] isn't always updated
State
- Fixed
PR #124
Severity
- Severity: Medium
Submitted by
Gerard Persoon
Description
The value of
_delegatedUnlockStamps[]isn't always updated:- a decrease in locking period doesn't decrease it;
- an increase in locking period doesn't increase;
- a redelegation doesn't decrease;
- it isn't cleanedup with
withdraw().
This can result in incorrect calculation of votes.
Recommendation
Consider updating
_delegatedUnlockStamps[]. This will require an additional datastructureHyperware
Delegations are stored in buckets to be able to selectively update them on delegations, locking period changes and
withdraw(). Shortening of locks is disallowedIn
updateDelegationMultipliers()a heuristic is used to detect self delegation because that hook does not receive the delegator address.
Low Risk2 findings
Accounts with address(0) have special meaning
State
Severity
- Severity: Low
Submitted by
Gerard Persoon
Description
Accounts with
address(0)have a special meaning, because the will update_totalMultipliers[].Note: the risk is limited because
_totalMultipliers[]will be overwritten again at the end of the functionrecomputeMultipliers().Recommendation
Consider checking no acounts with
address(0)are used.recomputeMultipliers() only works if all accounts are supplied
State
Severity
- Severity: Low
Submitted by
Gerard Persoon
Description
The function
recomputeMultipliers()only works correctly if all used accounts are supplied. This is because at the end all totals are calculated based on the calculatedtotalMonthlyVotes[].With a large number of accounts this might not fit within the gas limits (especially with eip-7825 - 16M. However about 64k gas is used per account which allows for about 256 accounts. According to the project there are currently 67 active accounts, so that should be no problem.
Recommendation
Consider checking that all accounts are supplied.
This can be done by checking that the sum of raw votes across accounts to equal
totalVotes.
Gas Optimizations1 finding
Accounts with balance == 0 can be ignored
State
Severity
- Severity: Gas optimization
Submitted by
Gerard Persoon
Description
Function
recomputeMultipliers()checks ifbalance > 0and skips some code if it doesn't.However the rest for the information for these addresses should also be 0 so they can be skipped.
Recommendation
DOublecheck the conclusion and consider changing the code to:
-if (balance > 0) { ... }+if (balance == 0) continue;