Olive Network

QuillAudits12 Apr 2024Files named in the report

Audit · firm’s term: audit report

QuillAudits reviewed Olive Network on 12 Apr 2024: 2 findings, 0 critical; all marked fixed.

No open critical findings

Open the report Open Olive Network’s security record

Report hosted on quillaudits.com.

Trustblock does not review code.

Findings2

Statuses are the security firm’s own, from its report.

Severity	Open	Acknowledged	Fixed
Critical	0	0	0
High	0	0	0
Medium	0	0	1
Low	0	0	1

MediumMissing gap variables could cause storage collisions when upgrades occurFixed

Upgradeable contracts allow for smart contracts to have extended functionality. The current codebase has the harvest() functions not implemented. They can be deployed as is, and upgraded at a later time to adjust the implementation. Within composable upgradeable contracts, the issue of storage collision exists which could alter the reading of storage for each of the contracts built atop each other.To avoid issues when reading or writing to storage it is advisable to have a gap introduced in each contract to prevent the new storage variables added from crossing into existing storage locations. Here, OpenZeppelin describes in detail how to manage smart contract storage with gaps: Writing Upgradeable Contracts - OpenZeppelin Docs

LowStrategyETH::rescue() can cause transactions to complete even with a silent uncaught failureFixed

The vanilla ERC20 transfer implementation returns a boolean value that indicates success or failure of the operation. This return value is stored in memory and a require check is performed on the value to provide details of success or failure on the finality of the operation. StrategyETH::rescue() does not include this check on the transfer function, and as such allows the function to run to completion even if the returned bool is false.