Byte Masons - Reliquary security record

In the contract `ATokensAndRatesHelper`, the role `owner` has authority over the following functions: - function initDeployment(), to initialize deployment, and set reserve interest rate strategy. - function configureReserves(), to config reserves, set the reserve collateral parameters, the reserve borrowing parameters, and the reserve factor. Any compromise to the `owner` account may allow a hacker to take advantage of this authority. In the contract `StableAndVariableTokensHelper`, the role `owner` has authority over the following functions: - function initDeployment(), to initialize deployment, deploy stable debt token and variable debt token. - function setOracleBorrowRates(), to set borrow rates of assets. - function setOracleOwnership(), to transfer the ownership of the contract `LendingRateOracle` to the `admin` address. Any compromise to the `owner` account may allow a hacker to take advantage of this authority. In the contract `BaseImmutableAdminUpgradeabilityProxy`, the role `ADMIN` has authority over the following functions: - function upgradeTo(), to upgrade the backing implementation of the proxy. - function upgradeToAndCall(), to upgrade the backing implementation of the proxy and call a function. Any compromise to the `ADMIN` account may allow a hacker to take advantage of this authority. In the contract `GranaryRewardsVault`, the role `owner` has authority over the following functions: - function emergencyEtherTransfer(), to transfer all amount of ETHs in the contract `GranaryRewardsVault` to any address. - function emergencyTokenTransfer(), to transfer any tokens in the contract `GranaryRewardsVault` to any address. Any compromise to the `owner` account may allow a hacker to take advantage of this authority. In the contract `GranaryRewardsVault`, the role `poolAdmin` has authority over the following functions: - function approveIncentivesController(), to sets `value` as the allowance of `INCENTIVES_CONTROLLER` over the contract `GranaryRewardsVault's` tokens. Any compromise to the `poolAdmin` account may allow a hacker to take advantage of this authority.

In the contract `Rewarder`, the role `owner` has authority over the following functions: - function setRewardsVault(), to the reward vault address for the reward. Any compromise to the `owner` account may allow a hacker to take advantage of this authority. In the contract `RewardsController`, the role `owner` has authority over the following functions: - function setClaimer(), to authorize the caller to claim the rewards of the user. - function configureAssets(), to configure the assets for a specific emission. Any compromise to the `_owner` account may allow a hacker to take advantage of this authority. In the contract `RewardsDistributor`, the role `owner` has authority over the following functions: - function setDistributionEnd(), to the end timestamp of distributing rewards. Any compromise to the `owner` account may allow a hacker to take advantage of this authority. In the contract `Timelock`, the role `admin` has authority over the following functions: - function queueTransaction(), to add a transaction to the execution queue. - function cancelTransaction(), to cancel a transaction. - function executeTransaction(), to execute a transaction. Any compromise to the `admin` account may allow a hacker to take advantage of this authority. In the contract `Ownable`, the role `owner` has authority over the following functions: - function renounceOwnership(), to renounce the ownership and leave the contract without the owner. - function transferOwnership(), to transfer the ownership of the contract to a new account. Any compromise to the `owner` account may allow a hacker to take advantage of this authority. In the contract `GranaryTreasury`, the role `owner` has authority over the following functions: - function transferToMultisig(), to any tokens in the contract `GranaryTreasury` to the `multisig` address. - function setMultisig(), to change the address of `multisig`. Any compromise to the `owner` account may allow a hacker to take advantage of this authority. In the contract `GranaryTreasury`, the role `poolAdmin` has authority over the following functions: - function setTreasury(), to set the new treasury address. Any compromise to the `poolAdmin` account may allow a hacker to take advantage of this authority. In the contract `Ownable`, the role `owner` has authority over the following functions: - function renounceOwnership(), to renounce the ownership and leave the contract without the owner. - function transferOwnership(), to transfer the ownership of the contract to a new account. Any compromise to the `owner` account may allow a hacker to take advantage of this authority. In the contract `AaveOracle`, the role `owner` has authority over the following functions: - function setAssetSources(), to set or replace sources of assets. - function setFallbackOracle(), to set the address of `fallbackOracle`. Any compromise to the `owner` account may allow a hacker to take advantage of this authority. In the contract `WETHGateway`, the role `owner` has authority over the following functions: - function authorizeLendingPool(), to authorize the `LendingPool`. - function emergencyTokenTransfer(), to transfer any tokens in the contract `WETHGateway` to any address. - function emergencyEtherTransfer(), to transfer all ETHs in the contract `WETHGateway` to any address. Any compromise to the `owner` account may allow a hacker to take advantage of this authority. In the contract `LendingPoolAddressesProvider`, the role `owner` has authority over the following functions: - function setMarketId(), to set the market which this `LendingPoolAddressesProvider` represents. - function setAddressAsProxy(), to update the implementation of a proxy registered with certain `id`. - function setAddress(), to set an address for an id replacing the address saved in the addresses map. - function setLendingPoolImpl(), to set the implementation of the `LendingPool`. - function setLendingPoolConfiguratorImpl(), to update the implementation of the `LendingPoolConfigurator`. - function setLendingPoolCollateralManager(), to update the address of the `LendingPoolCollateralManager`. - function setPoolAdmin(), to set the pool admin. - function setEmergencyAdmin(), to set the emergency admin. - function setPriceOracle(), to set the price oracle. - function setLendingRateOracle(), to set the lending rate oracle. Any compromise to the `owner` account may allow a hacker to take advantage of this authority. In the contract `LendingPoolAddressesProviderRegistry`, the role `owner` has authority over the following functions: - function registerAddressesProvider(), to register an addresses provider. - function unregisterAddressesProvider(), to removes a LendingPoolAddressesProvider from the list of registered addresses provider. Any compromise to the `owner` account may allow a hacker to take advantage of this authority.

Boolean constants can be used directly and do not need to be compared to true or false.

When transferring standard ERC20 deflationary tokens, the input amount may not be equal to the received amount due to the charged transaction fee. As a result, an inconsistency in the amount will occur and the transaction may fail due to the validation checks.

There should always be events emitted in the sensitive functions that are controlled by centralization roles.

The **require** can be used to check for conditions and throw an exception if the condition is not met. It is better to provide a string message containing details about the error that will be passed back to the caller.

Addresses should be checked before assignment or external call to make sure they are not zero addresses. ```solidity=25 (bool success, ) = _logic.delegatecall(_data); ``` - `_logic` is not zero-checked before being used. --- ```solidity=43 pool = _pool; ``` - `_pool` is not zero-checked before being used. --- ```solidity=44 addressesProvider = _addressesProvider; ``` - `_addressesProvider` is not zero-checked before being used. --- ```solidity=45 poolConfigurator = _poolConfigurator; ``` - `_poolConfigurator` is not zero-checked before being used. --- ```solidity=28 _owner = msgSender; ``` - `msgSender` is not zero-checked before being used. --- ```solidity=46 BASE_CURRENCY = baseCurrency; ``` - `baseCurrency` is not zero-checked before being used. --- ```solidity=435 (bool success, bytes memory result) = collateralManager.delegatecall( abi.encodeWithSignature( 'liquidationCall(address,address,address,uint256,bool)', collateralAsset, debtAsset, user, debtToCover, receiveAToken ) ); ``` - `collateralAsset` is not zero-checked before being used. --- ```solidity=20 ADMIN = admin; ``` - `admin` is not zero-checked before being used. --- ```solidity=69 (bool success, ) = newImplementation.delegatecall(data); ``` - `newImplementation` is not zero-checked before being used. --- ```solidity=96 _treasury = treasury; ``` - `treasury` is not zero-checked before being used. --- ```solidity=97 _underlyingAsset = underlyingAsset; ``` - `underlyingAsset` is not zero-checked before being used. --- ```solidity=55 _underlyingAsset = underlyingAsset; ``` - `underlyingAsset` is not zero-checked before being used. --- ```solidity=49 _underlyingAsset = underlyingAsset; ``` - `underlyingAsset` is not zero-checked before being used. --- ```solidity=30 admin = admin_; ``` - `admin_` is not zero-checked before being used. --- ```solidity=55 pendingAdmin = pendingAdmin_; ``` - `pendingAdmin_` is not zero-checked before being used. --- ```solidity=99 (bool success, bytes memory returnData) = target.call.value(value)(callData); ``` - `target` is not zero-checked before being used. --- ```solidity=54 currentTreasury = newTreasury; ``` - `newTreasury` is not zero-checked before being used. --- ```solidity=58 multisig = newMultisig; ``` - `newMultisig` is not zero-checked before being used. --- ```solidity=25 INCENTIVES_CONTROLLER = incentivesController; ``` - `incentivesController` is not zero-checked before being used. --- ```solidity=27 REWARD_TOKEN = rewardToken; ``` - `rewardToken` is not zero-checked before being used. --- ```solidity=35 (bool success, ) = to.call{value: amount}(new bytes(0)); ``` - `to` is not zero-checked before being used.

The asset `StableDebtToken` is not supported since the contract `StableDebtToken` does not inherit the interface `IScaledBalanceToken` and not implement the functions `scaledTotalSupply()` and `getScaledUserBalanceAndSupply()`. ```solidity=33 for (uint256 i = 0; i < config.length; i++) { config[i].totalSupply = IScaledBalanceToken(config[i].asset).scaledTotalSupply(); } ``` ```solidity=115 for (uint256 i = 0; i < assets.length; i++) { userState[i].underlyingAsset = assets[i]; (userState[i].userBalance, userState[i].totalSupply) = IScaledBalanceToken(assets[i]) .getScaledUserBalanceAndSupply(user); } ```

The `permit` function performs the operation of deriving signer address from the signature values of `v`, `r` and `s`. The state variable `DOMAIN_SEPARATOR` that is used to calculate hash has a value of `chainid` that is derived only once in the constructor, which does not change after contract deployment. The issue arises in the event of fork when the cross-chain replay attacks can be executed. The attack scenario can be thought of as if a fork of Ethereum happens and two different networks have id of for example `1` and `9`. The `chainid` coded in `DOMAIN_SEPARATOR` will be the same on contracts residing in both of the forks. If the chainid `1` is stored in the contract then the `permit` transaction signed for chainid `1` will be executable on both of the forks.

Malicious hackers may observe the pending transaction which will execute the `initialize` function and launch a similar transaction with the hacker's address and set variables of the contract.