PerlinXRewards.sol

Quantstamp4 Aug 2020Files named in the report

Quantstamp reviewed PerlinX (PerlinXRewards.sol) on 4 Aug 2020: 13 findings, 0 critical; 7 marked fixed, 6 acknowledged.

No open critical findings

Open the report Open PerlinX’s security record

Report hosted on certificate.quantstamp.com.

Trustblock does not review code.

Findings13

Statuses are the security firm’s own, from its report.

Severity	Acknowledged	Fixed
Critical	0	0
High	0	2
Medium	1	0
Low	5	5

HighA user can increase their shares arbitrarilyFixed

`L244` accumulates based on the input amount. In addition, the function `registerAllClaims` can be called by anyone at any time. So one can call the function `registerAllClaims` multiple times to increase its ratio of `memberClaimInEra`/`totalClaimsInEra`.

HighMissing balance check after transfer of ERC20 tokenFixed

The transfer of ERC20 will not always be successful. Hence, the success of `transferFrom`/`transfer` on `L200`, `225`, `L234`, `L265` should be checked.

Low`snapshotPoolsInEra` can be called on past erasFixed

Currently, it is possible to call `snapshotPoolsInEra` on past eras, that is, on eras whose value is less than `currentEra`.

Low`updateRewards` may run out of gasFixed

The loop in `updateRewards` expects the pool count to be less than `100`; however, the code does not bound `arraySynths` in any manner. If not controlled for, the function `updateRewards` may reach a point of never working again due to high gas costs. P.S. The Perlin team said that they're aware of this and the loop count is planned to be less than 100, so it might not be a problem as long as this maximum loop count is being carefully maintained.

LowIncorrect weight precisionFixed

On `L124`, the requirement statement checks that the weight is greater than or equal to `1` and less than or equal to `1000`. The corresponding message says: "Must be greater than 0.1, less than 10". Taking `1000` to be the baseline, the contract is representing the weight with two decimal precision; hence 1 shall denote `0.01`, instead of `0.1` as the message suggests. An incorrect requirement statement message may inadvertently convey the incorrect precision, which could cause callees to incorrectly adjust the weight as a consequence.

LowModifier `flashSafe()` cannot avoid flash loan and reentrancyFixed

An attacker’s TX could pass this modifier by using multiple contracts to change their `msg.sender`.

LowUnlocked PragmaFixed

Every Solidity file specifies in the header a version number of the format `pragma solidity (^)0.4.*`. The caret (`^`) before the version number implies an unlocked pragma, meaning that the compiler will use the specified version _and above_, hence the term "unlocked." For consistency and to prevent unexpected behavior in the future, it is recommended to remove the caret to lock the file onto a specific Solidity version.