Hedgehog

In the `lib.rs` file (L2677), located in `hh-paramitiuel` module, the address of the parimutuel is not verified; thus an attacker can execute remote code .

The `find_user_reward` function in `hh-parimutuel/src/lib.rs` calculates the reward user, but in line 1722 it compares two variables: `FINAL_LEADERBOARD_LENGTH` and `counter + n`. The problem is that the addition is done with the `+` operator, which can cause an overflow. If one uses the debug build it can cause a panic; however in release build it will overflow silently. Same issue on L1741.

In the `init_reward_info` function (see file `hh-vault/src/lib.rs` file, L1038), the `vault.reward_sources` is incremented by one using the `+` operator, which can cause an overflow. If one uses the debug build, it can cause a panic; however, in release build it will overflow silently.

In the `handle_deposit` function (file `/hh-vault/src/lib.rs`, L2994 and 2995), the `state.sponsor_tokens_owned` and `state.amount` variables are incremented using the `+` operator, which can cause an overflow. If one uses the debug build, it can cause a panic; however, in release build it will overflow silently.

In the `deposit_to_vault/withdraw_from_vault` function, the `vault.total_amount_deposited` and `vault.total_amount_sponsored` variables are incremented/decremented using the `+/-` operators, which can cause an overflow and underflow, respectively. If one uses the debug build, it can cause a panic; however, in release build it will overflow silently. This appears in `/hh-vault/src/lib.rs`, lines 1856, 1858, 2326, and 2328.

The `lib.rs` file, located in the `hh-vault` module, contains code that is completely commented out--see L883 and 1441. This is currently dead code.

We found some functions marked as deprecated; if these functions are not used anymore, the team should consider removing them. This appears in `hh-vault/src/lib.rs`, on lines 843, 919, 1315, 2538, 2562, and 2777.

In the `enter_prediction ` function in `lib.rs` file (L256), located in the `hh-paramitiuel` module, one enters a prediction for a specified market, as well as an amount. The amount variable, however, is not verified and it can be given the zero value.

The `add_user_and_deposit_full`function in `hh-vault/src/apricot.rs` takes two parameters, `amount` and `pool_id`. These parameters are not verified; also, one can inject an ID of a non-existent pool . See lines 60, 61, 102, and 103.

The `lib.rs` file (L39), located in the `hh-vault` module, contains the `init_vault` public function. With the help of this function one can initialize a vault with some parameters. Amongst these parameters is the `_lockup_expiry`, which is a timestamp . The problem here is that there is no verification of this variable; in fact one can initialize a vault with a `_lockup_expiry` lower than the current time. In the latter case, one can harm the logic of the program.