ParaSpace (Audit #3)

CertiK23 Dec 2022Files named in the report

CertiK reviewed ParaSpace Lending V1 (ParaSpace (Audit #3)) on 23 Dec 2022: 15 findings, 0 critical; 4 marked fixed, 1 acknowledged, 10 open.

No open critical findings

Open the report Open ParaSpace Lending V1’s security record

Report hosted on skynet.certik.com.

Trustblock does not review code.

Findings15

Statuses are the security firm’s own, from its report.

Severity	Open	Acknowledged	Fixed
Critical	0	0	0
High	0	1	1
Medium	0	0	1
Low	10	0	2

HighNo Access Restriction On Function `removeFeeder()Fixed

The function `removeFeeder()` in the aforementioned line can be called by anyone as it has no access restriction. This enables anyone to call this function to remove the price feeder and revoke the `UPDATE_ROLE` of the feeder. **Attack Scenario** Anyone is free to remove any Oracle price feeder. **Proof of concept** PoC exploit code is not necessary in this case. The finding is straightforward and about access restriction on function.

MediumNot Withdraw Rewards While Transferring AssetFixed

The functions `transfer()` and `transferFrom()` are not overridden to withdraw all staked and pending rewards before transferring the asset. So the original owner of the asset will potentially lose some staking and reward tokens. **Proof of concept** 1. User A supplies the BAYC/MAYC and gets the BAYC/MAYC NToken, then stakes the APE with their BAYC/MAYC NToken. 2. User A transfers the BAYC/MAYC NToken to User B. User A will lose the staked APE coins and rewards.

LowRedundant Modifier `onlyWhenAssetExisted` On FuncFixed

The modifier `onlyWhenAssetExisted` is redundant on the function `removeAsset()`, because it is declared on the internal function `_removeAsset()`.

LowWithdraw Balance Is Not Properly CalculatedFixed

The withdrawal amount of Ape coins from the staking contract is not properly calculated, this will transfer all Ape coins left in the current contract to the recipient. The token balance should be checked before and after the withdrawal. ```solidity=38 function withdrawBAKC( ApeCoinStaking _apeCoinStaking, uint256 poolId, ApeCoinStaking.PairNftWithAmount[] memory _nftPairs, address _apeRecipient ) external { ApeCoinStaking.PairNftWithAmount[] memory _otherPairs = new ApeCoinStaking.PairNftWithAmount[](0); if (poolId == BAYC_POOL_ID) { _apeCoinStaking.withdrawBAKC(_nftPairs, _otherPairs); } else { _apeCoinStaking.withdrawBAKC(_otherPairs, _nftPairs); } uint256 balance = _apeCoinStaking.apeCoin().balanceOf(address(this)); _apeCoinStaking.apeCoin().safeTransfer(_apeRecipient, balance); } ```