Altrucoin

CertiK28 Feb 2023Files named in the report

Audit

CertiK reviewed Altrucoin on 28 Feb 2023: 19 findings, 0 critical; 14 marked fixed, 1 acknowledged, 4 open.

No open critical findings

Open the report Open Altrucoin’s security record

Report hosted on skynet.certik.com.

Trustblock does not review code.

Findings19

Statuses are the security firm’s own, from its report.

Severity	Open	Acknowledged	Fixed
Critical	0	0	0
High	0	1	0
Medium	0	0	0
Low	4	0	14

LowComparison to Boolean ConstantFixed

Boolean constants can be used directly and do not need to be compared to true or false.

LowEmpty `else` BlockFixed

The linked lines of code highlight an `else` block that has no implementation.

LowFunctions Can Be Declared `external`Fixed

`public` functions which are never called internally within the contract should have `external` visibility.

LowInconsistent Comments and CodeFixed

There is a discrepancy between the following comments and lines of code: ```solidity=136 uint256 private MIN_LOCK_DURATION = 1 days; // 1 week uint256 private MIN_BONDING_LOCK_DURATION = 30 days; // 365 days ```

LowLack Of Validation Of `minLock`Fixed

There are currently no checks ensuring the value of `MIN_LOCK_DURATION` is less than `MAX_LOCK_DURATION`.

LowMissing Validation Of Decimal ValuesFixed

Upon contract deployment, the deployer must manually pass the values for `tokenDecimal` and `dualTokenDecimal`, however, there are no checks to ensure the values are the correct decimal values for the correspondent IERC20 contract address.

LowRemoval of **require** StatementsFixed

The linked **require** statements are important for input validation and have been commented out. As these are values set by the deployer this finding is only informational.

LowThird Party DependencyFixed

The contract is serving as the underlying entity to interact with one or more third party protocols. The scope of the audit treats third party entities as black boxes and assume their functional correctness. However, in the real world, third parties can be compromised and this may lead to lost or stolen assets. In addition, upgrades of third parties can possibly create severe impacts, such as increasing fees of third parties, migrating to new LP pools, etc. ```solidity=90 IRewardDistributorV6 private rewardDistributor; //block based distributor contract ``` - The contract `StakingVaultV600` interacts with third party contract with `IRewardDistributorV6` interface via `rewardDistributor`. --- ```solidity=91 IFeeDistributorV6 private feeDistributor; //fee distribution contract ``` - The contract `StakingVaultV600` interacts with third party contract with `IFeeDistributorV6` interface via `feeDistributor`.

LowTypo in Function NameFixed

The external call to the `feeDistributor` contract attempts to utilize the `getFreeEntryExtiFeeUsers()`, however, in the current codebase there is a typo, and, as a result, the call will fail since that function does not exist.

LowUninitialized Local VariableFixed

```solidity=373 uint256 currentAmount; //will be existing locked balance + new tokens in tokens (not shares) ``` - Local variable `currentAmount` is never initialized. --- ```solidity=374 uint256 userCurrentLockedBalance; ``` - Local variable `userCurrentLockedBalance` is never initialized. --- ```solidity=1035 uint256 tokenHarvest; ``` - Local variable `tokenHarvest` is never initialized. --- ```solidity=1036 uint256 dualTokenHarvest; ``` - Local variable `dualTokenHarvest` is never initialized.

Show 4 more

LowUnused ParameterFixed

The parameters `tokenDecimals_` and `dualTokenDecimals_` are not used in the function.

LowVariable Assignment Immediately OverwrittenFixed

The state variable `BOOST_WEIGHT` is initialized and assigned a value of 2000 * 1e10, however, upon contract deployment, the value of `BOOST_WEIGHT` is overwritten by the passed value in the constructor.

LowVariables That Could Be Declared as `immutable`Fixed

The linked variables assigned in the constructor can be declared as `immutable`. Immutable state variables can be assigned during contract creation but will remain constant throughout the lifetime of a deployed contract. A big advantage of immutable variables is that reading them is significantly cheaper than reading from regular state variables since they will not be stored in storage.

LowWrong Variable Used For CalculationFixed

```solidity=350 if(totalLockDuration > MAX_LOCK_DURATION) { _lockDuration = MAX_LOCK_DURATION - (user.lockEndTime[_slot] - block.timestamp); } else { } // Update lock duration. if (_lockDuration > 0) { if (user.lockEndTime[_slot] < block.timestamp) { //if unlocked user.lockStartTime[_slot] = block.timestamp; user.lockEndTime[_slot] = block.timestamp + _lockDuration; //makes lock time = to new lock time only } else { //if locked if(totalLockDuration > MAX_LOCK_DURATION) { user.lockEndTime[_slot] = block.timestamp + MAX_LOCK_DURATION; } else { user.lockEndTime[_slot] += _lockDuration; //extends existing lock time } } user.locked[_slot] = true; } ``` In the code shown above, the variable `_lockDuration` is calculated and should be used to calculate the `user.lockEndTime[_slot]`. However, as the code is written, `MAX_LOCK_DURATION` is mistakenly used instead in line 363.