Lakefront Audit

A reentrancy attack can occur when the contract creates a function that makes an external call to another untrusted contract before resolving any effects. If the attacker can control the untrusted contract, they can make a recursive call back to the original function, repeating interactions that would have otherwise not run after the external call resolved the effects. *This finding is considered minor because the state variable is only incremented or decremented. So, the effect of out-of-order increments may be unobservable after transaction. However, the reentrancy vulnerability may still cause other issues in the middle of transaction.* ### External call(s) ```solidity=162 _harvest(); ``` * This function call executes the following external call(s). * In `SafeERC20._callOptionalReturn`, * `returndata = address(token).functionCall(data,SafeERC20: low-level call failed)` * In `StrategyCurveLP._harvest`, * `IGaugeFactory(gaugeFactory).mint(rewardsGauge)` * In `StrategyCurveLP.swapRewardsToNative`, * `IUniswapRouterETH(crvRouter).swapExactTokensForTokens(crvBal,0,crvToNativeRoute,address(this),block.timestamp)` * In `StrategyCurveLP.deposit`, * `IRewardsGauge(rewardsGauge).deposit(wantBal)` * In `StrategyCurveLP.chargeFees`, * `IERC20(native).safeTransfer(tx.origin,callFeeAmount)` * In `StrategyCurveLP._harvest`, * `IRewardsGauge(rewardsGauge).claim_rewards(address(this))` * In `StrategyCurveLP.chargeFees`, * `IERC20(native).safeTransfer(companyFeeRecipient,companyFeeAmount)` * In `Address.functionCallWithValue`, * `(success,returndata) = target.call{value: value}(data)` * In `StrategyCurveLP.addLiquidity`, * `IUniswapRouterETH(unirouter).swapExactTokensForTokens(nativeBal,0,nativeToDepositRoute,address(this),block.timestamp)` * In `StrategyCurveLP.chargeFees`, * `IERC20(native).safeTransfer(strategist,strategistFeeAmount)` * In `StrategyCurveLP.addLiquidity`, * `IWrappedNative(native).withdraw(depositNativeAmount)` * In `StrategyCurveLP.swapRewardsToNative`, * `IUniswapRouterETH(unirouter).swapExactTokensForTokens(bal,0,rewards[i].toNativeRoute,address(this),block.timestamp)` * In `StrategyCurveLP.addLiquidity`, * `ICurveSwap(pool).add_liquidity(amounts,0,true)` * In `StrategyCurveLP.addLiquidity`, * `ICurveSwap(pool).add_liquidity{value: depositNativeAmount}(amounts,0)` * In `StrategyCurveLP.addLiquidity`, * `ICurveSwap(pool).add_liquidity(amounts_scope_0,0,true)` * In `StrategyCurveLP.addLiquidity`, * `ICurveSwap(pool).add_liquidity(want,amounts_scope_0,0)` * In `StrategyCurveLP.addLiquidity`, * `ICurveSwap(pool).add_liquidity(amounts_scope_0,0)` * In `StrategyCurveLP.addLiquidity`, * `ICurveSwap(pool).add_liquidity(want,amounts_scope_1,0)` * In `StrategyCurveLP.addLiquidity`, * `ICurveSwap(pool).add_liquidity(amounts_scope_1,0)` * In `StrategyCurveLP.addLiquidity`, * `ICurveSwap(pool).add_liquidity(amounts_scope_2,0)` ```solidity=161 function harvest() external virtual whenNotPaused gasThrottle { ``` * This function call executes the following external call(s). * In `GasThrottler.gasThrottle`, * `require(bool,string)(tx.gasprice <= IGasPrice(gasprice).maxGasPrice(),gas is too high!)` ### State variables written after the call(s) ```solidity=162 _harvest(); ``` * This function call executes the following assignment(s). * In `StrategyCurveLP._harvest`, * `lastHarvest = block.timestamp` --- ### External call(s) ```solidity=172 IGaugeFactory(gaugeFactory).mint(rewardsGauge); ``` ```solidity=174 IRewardsGauge(rewardsGauge).claim_rewards(address(this)); ``` ```solidity=175 swapRewardsToNative(); ``` * This function call executes the following external call(s). * In `StrategyCurveLP.swapRewardsToNative`, * `IUniswapRouterETH(crvRouter).swapExactTokensForTokens(crvBal,0,crvToNativeRoute,address(this),block.timestamp)` * In `StrategyCurveLP.swapRewardsToNative`, * `IUniswapRouterETH(unirouter).swapExactTokensForTokens(bal,0,rewards[i].toNativeRoute,address(this),block.timestamp)` ```solidity=178 chargeFees(); ``` * This function call executes the following external call(s). * In `SafeERC20._callOptionalReturn`, * `returndata = address(token).functionCall(data,SafeERC20: low-level call failed)` * In `StrategyCurveLP.chargeFees`, * `IERC20(native).safeTransfer(tx.origin,callFeeAmount)` * In `StrategyCurveLP.chargeFees`, * `IERC20(native).safeTransfer(companyFeeRecipient,companyFeeAmount)` * In `Address.functionCallWithValue`, * `(success,returndata) = target.call{value: value}(data)` * In `StrategyCurveLP.chargeFees`, * `IERC20(native).safeTransfer(strategist,strategistFeeAmount)` ```solidity=179 addLiquidity(); ``` * This function call executes the following external call(s). * In `StrategyCurveLP.addLiquidity`, * `IUniswapRouterETH(unirouter).swapExactTokensForTokens(nativeBal,0,nativeToDepositRoute,address(this),

A sandwich attack might happen when an attacker observes a transaction swapping tokens or adding liquidity without setting restrictions on slippage or minimum output amount. The attacker can manipulate the exchange rate by frontrunning (before the transaction being attacked) a transaction to purchase one of the assets and make profits by backrunning (after the transaction being attacked) a transaction to sell the asset. The following functions are called without setting restrictions on slippage or minimum output amount, so transactions triggering these functions are vulnerable to sandwich attacks, especially when the input amount is large: - `add_liquidity()` - `swapExactTokensForTokens()`

The contract is serving as the underlying entity to interact with one or more third party protocols. The scope of the audit treats third party entities as black boxes and assume their functional correctness. However, in the real world, third parties can be compromised and this may lead to lost or stolen assets. In addition, upgrades of third parties can possibly create severe impacts, such as increasing fees of third parties, migrating to new LP pools, etc. ```solidity=30 function deposit(address _shipyardVaultAddress, address _depositTokenAddress, uint256 _amountInDepositToken) external nonReentrant { ``` - The function `ShipyardOneClickCurve.deposit` interacts with third party contract with `IUniswapRouterETH` interface via `_shipyardVaultAddress`. --- ```solidity=113 function withdraw(address _shipyardVaultAddress, address _requestedTokenAddress, uint256 _withdrawAmountInShipToken) external nonReentrant { ``` - The function `ShipyardOneClickCurve.withdraw` interacts with third party contract with `ICurveSwap` interface via `_shipyardVaultAddress`. --- ```solidity=25 address public native; ``` - The contract `StrategyCurveLP` interacts with third party contract with `IWrappedNative` interface via `native`. --- ```solidity=29 address public gaugeFactory; ``` - The contract `StrategyCurveLP` interacts with third party contract with `IGaugeFactory` interface via `gaugeFactory`. --- ```solidity=30 address public rewardsGauge; ``` - The contract `StrategyCurveLP` interacts with third party contract with `IRewardsGauge` interface via `rewardsGauge`. --- ```solidity=31 address public pool; ``` - The contract `StrategyCurveLP` interacts with third party contract with `ICurveSwap` interface via `pool`. --- ```solidity=51 address public crvRouter; ``` - The contract `StrategyCurveLP` interacts with third party contract with `IUniswapRouterETH` interface via `crvRouter`. --- ```solidity=23 IStrategy public strategy; ``` - The contract `ShipyardVault` interacts with third party contract with `IStrategy` interface via `strategy`.