The Karma Pad - Audit

`addLiquidity()` uses `devWallet` address as an LP recipient. This allows the `devWallet` to extract all the funds from the AMM pair.

During the execution of the `distributeDividend` function, users' rewards are distributed by invoking the `transfer` function. However, if the reward token is ERC1363 and the user is a malicious smart contract that reverts any payment, the function will be reverted.

There is no storage gap preserved in the logic contract. Any logic contract that acts as a base contract that needs to be inherited by other upgradeable child should have a reasonable size of storage gap preserved for the new state variable introduced by the future upgrades.

If the value of `gasleft()` outside the `while` loop is less than the passed parameter `gas`, the `while` loop may throw an `out-of-gas` exception. ``` solidity=126 while (gasUsed < gas && iterations < shareholderCount) { if (currentIndex >= shareholderCount) { currentIndex = 0; } if (shouldDistribute(shareholders[currentIndex])) { distributeDividend(shareholders[currentIndex]); } gasUsed = gasUsed.add(gasLeft.sub(gasleft())); gasLeft = gasleft(); currentIndex++; iterations++; } ```

A reentrancy attack can occur when the contract creates a function that makes an external call to another untrusted contract before resolving any effects. If the attacker can control the untrusted contract, they can make a recursive call back to the original function, repeating interactions that would have otherwise not run after the external call resolved the effects. ### External call(s) ```solidity=77 distributeDividend(shareholder); ``` * This function call executes the following external call(s). * In `DividendDistributor.distributeDividend`, * `rewardToken.transfer(shareholder,amount)` ### State variables written after the call(s) ```solidity=87 shares[shareholder].amount = amount; ``` ```solidity=88 shares[shareholder].totalExcluded = getCumulativeDividends( shares[shareholder].amount ); ``` --- ### External call(s) ```solidity=132 distributeDividend(shareholders[currentIndex]); ``` * This function call executes the following external call(s). * In `DividendDistributor.distributeDividend`, * `rewardToken.transfer(shareholder,amount)` ### State variables written after the call(s) ```solidity=128 currentIndex = 0; ``` ```solidity=137 currentIndex++; ``` --- ### External call(s) ```solidity=160 rewardToken.transfer(shareholder, amount); ``` ### State variables written after the call(s) ```solidity=162 shares[shareholder].totalRealised = shares[shareholder] .totalRealised .add(amount); ``` ```solidity=165 shares[shareholder].totalExcluded = getCumulativeDividends( shares[shareholder].amount ); ```

State variables initialized when declared are equivalent to initializing them inside the constructor. Therefore, initializing state variables when declared in an upgradeable contract has no actual effect since the constructor of an upgradeable contract is never called.

An uninitialized storage variable will contain references to state variables and a critical state variable may be modified unexpectedly.

Functions `deposit()` and `setDistributionCriteria()` in `DividendDistributor` are decorated with the modifier `onlyToken`. Based on our understanding, the token address is contract `ReflectionToken`. However, contract `ReflectionToken` does not call deposit/setDistributionCriteria inside its contract. Therefore, deposit/setDistributionCriteria cannot be called by anyone.

Signed messages are not properly verified with the current chain ID, thus allowing attackers to perform replay attacks across chains. Hardcoded or cached chain ID values are also vulnerable since a hard fork may occur and change the chain ID in the future. ```solidity=100 verifyEIP712(owner, hashStruct, v, r, s) || verifyPersonalSign(owner, hashStruct, v, r, s), ``` - Calling `verifyPersonalSign`, which eventually calls `ecrecover`. ```solidity=125 address signer = ecrecover(hash, v, r, s); ``` - Calling `ecrecover` with a hash that does not properly include the chain ID. --- ```solidity=112 bytes32 hash = keccak256(abi.encodePacked('\x19\x01', DOMAIN_SEPARATOR, hashStruct)); ``` - Reading a state variable `DOMAIN_SEPARATOR`, which seems to use a cached chain ID value. - Encoding the cached chain ID value `DOMAIN_SEPARATOR`. ```solidity=113 address signer = ecrecover(hash, v, r, s); ``` - Calling `ecrecover` with a hash that does not properly include the chain ID.

Performing division by zero would raise an error and revert the transaction. ```solidity=110 dividendsPerShareAccuracyFactor.mul(amount).div(totalShares) ``` The expression `dividendsPerShareAccuracyFactor.mul(amount).div(totalShares)` may divide by zero. Its divisor has has estimated interval [0, 115792089237316195423570985008687907853269984665640564039457584007913129639935].