Hyperware

Hyperware fixes

Cantina Security Report

Organization

@Hyperware

Engagement Type

Cantina Reviews

Period

-


Findings

Medium Risk

1 findings

1 fixed

0 acknowledged

Low Risk

2 findings

2 fixed

0 acknowledged

Gas Optimizations

1 findings

1 fixed

0 acknowledged


Medium Risk1 finding

  1. _delegatedUnlockStamps[] isn't always updated

    State

    Fixed

    PR #124

    Severity

    Severity: Medium

    Submitted by

    Gerard Persoon


    Description

    The value of _delegatedUnlockStamps[] isn't always updated:

    • a decrease in locking period doesn't decrease it;
    • an increase in locking period doesn't increase;
    • a redelegation doesn't decrease;
    • it isn't cleanedup with withdraw().

    This can result in incorrect calculation of votes.

    Recommendation

    Consider updating _delegatedUnlockStamps[]. This will require an additional datastructure

    Hyperware

    Delegations are stored in buckets to be able to selectively update them on delegations, locking period changes and withdraw(). Shortening of locks is disallowed

    In updateDelegationMultipliers() a heuristic is used to detect self delegation because that hook does not receive the delegator address.

Low Risk2 findings

  1. Accounts with address(0) have special meaning

    Severity

    Severity: Low

    Submitted by

    Gerard Persoon


    Description

    Accounts with address(0) have a special meaning, because the will update _totalMultipliers[].

    Note: the risk is limited because _totalMultipliers[] will be overwritten again at the end of the function recomputeMultipliers().

    Recommendation

    Consider checking no acounts with address(0) are used.

  2. recomputeMultipliers() only works if all accounts are supplied

    Severity

    Severity: Low

    Submitted by

    Gerard Persoon


    Description

    The function recomputeMultipliers() only works correctly if all used accounts are supplied. This is because at the end all totals are calculated based on the calculated totalMonthlyVotes[].

    With a large number of accounts this might not fit within the gas limits (especially with eip-7825 - 16M. However about 64k gas is used per account which allows for about 256 accounts. According to the project there are currently 67 active accounts, so that should be no problem.

    Recommendation

    Consider checking that all accounts are supplied.

    This can be done by checking that the sum of raw votes across accounts to equal totalVotes.

Gas Optimizations1 finding

  1. Accounts with balance == 0 can be ignored

    Severity

    Severity: Gas optimization

    Submitted by

    Gerard Persoon


    Description

    Function recomputeMultipliers() checks if balance > 0 and skips some code if it doesn't.

    However the rest for the information for these addresses should also be 0 so they can be skipped.

    Recommendation

    DOublecheck the conclusion and consider changing the code to:

    -if (balance > 0) { ... }+if (balance == 0) continue;