Phuture.Finance (Audit #2)

CertiK15 Dec 2022Files named in the report

CertiK reviewed Phuture (Phuture.Finance (Audit #2)) on 15 Dec 2022: 8 findings, 0 critical; 4 marked fixed, 4 acknowledged.

No open critical findings

Open the report Open Phuture’s security record

Report hosted on skynet.certik.com.

Trustblock does not review code.

Findings8

Statuses are the security firm’s own, from its report.

Severity	Acknowledged	Fixed
Critical	0	0
High	2	0
Medium	0	1
Low	2	3

HighCentralization Risks in IndexBetting.solAcknowledged

In the contract `IndexBetting` the role `_owner` has authority over the functions shown in the diagram below. Any compromise to the `_owner` account may allow the hacker to take advantage of this authority and arbitrarily set/update the betting start time and end time, and change the implementation contract. ![](https://accelerator-tasks-prod.acc.corp.certik.com/8a3f7a9e6204403585dd4cfee92162dc/diagrams/centralization_IndexBetting-IndexBetting-_owner.svg)

HighCentralized Control of Contract UpgradeAcknowledged

Contract `IndexBetting` is an upgradeable contract, the owner/deployer can upgrade the contract without the community's commitment. If an attacker compromises the account, he can change the implementation of the contract and drain tokens from the contract.

LowMissing Sanity Check on Challenge Outcome SettingAcknowledged

Functions `setChallengeOutcome()` and `setChallengeOutcomeForRoundId()` could be called before betting started. In this case, `startEpoch.PDIPrice` and `startEpoch.DPIPrice` would be 0, and the transaction would revert when dividing these zero values on line 246 and 247. ```solidity=243 function _setPDIRewardRate(int256 _DPIPrice) internal { endEpoch.PDIPrice = getLatestPDIPrice(); endEpoch.DPIPrice = uint256(_DPIPrice).toUint112(); PDIRewardRate = (endEpoch.PDIPrice * 10 ** BASE_AGGREGATOR_DECIMALS) / startEpoch.PDIPrice >= (endEpoch.DPIPrice * 10 ** BASE_AGGREGATOR_DECIMALS) / startEpoch.DPIPrice ? VICTORY_REWARD_RATE : DEFEAT_REWARD_RATE; } ```

LowThird Party DependenciesAcknowledged

The contract is serving as the underlying entity to interact with multiple third party protocols or out-of-scope contracts, as listed below. The scope of the audit treats 3rd party and external entities as black boxes and assumes their functional correctness. However, in the real world, they can be compromised and this may lead to lost or stolen assets. Additionally, upgrades of 3rd parties can possibly create severe impacts, such as increasing fees, migrating to new LP pools, etc. The contract relies on: - Chainlink aggregator for DPI token price. - `IndexHelper` for PDI token price. - `IndexRouter` for `withdrawAndMint()`. `IndexRouter` is also approved to any staking token in `IndexBetting` contract. - user-defined `swapTarget` address to swap between staking and reward tokens. - External DPI and PDI ERC20 tokens for staking and reward. - FixedPointMathLib for calculation.