PoolTogether — Sushi and Yearn V2 Yield Sources

Off-Chain (Private)

Audited on 2021/04/30

1 active critical issue

Summary

Executive Summary This report presents the results of our engagement with PoolTogether to review their Sushi and Yearn V2 yield sources. The review was conducted over one week, from May 24 to May 28 by Heiko Fisch and Sergii Kravchenko. A total of 10 person-days were spent. Scope Our review focused on the commit hashes ccaf9d73f8cf5c0c41f6e4d640d9b186c51bc3ce for the Sushi yield source and a34857f1555908a6263d2ebd189f0cb40e1858da for the Yearn V2 yield source. The list of files in scope can be found in the Appendix.

Project

PoolTogether

Multi-Chain

Issues (8)

	Low	Medium	High	Critical	Total
Not fixed	4	2	1	1	8
Fixed	-	-	-	-	0
Total	4	2	1	1	8

Contracts (3)

#	File Name
1	contracts/ISushi.sol
2	contracts/SushiYieldSource.sol
3	contracts/ISushiBar.sol

#	File Name
1	contracts/ISushi.sol
2	contracts/SushiYieldSource.sol
3	contracts/ISushiBar.sol

PoolTogether — Sushi and Yearn V2 Yield Sources

Summary

Issues (8)

Yearn: Re-entrancy attack during depositnot_fixed/critical

Yearn: Partial deposits are not processed properlynot_fixed/high

Sushi: balanceOfToken underestimates balancenot_fixed/medium

Sushi: redeemToken redeems less than it shouldnot_fixed/medium

Sushi: Some state variables should be immutable and have more specific typesnot_fixed/low

Contracts (3)