Chronos security record

There should always be events emitted in the sensitive functions that are controlled by centralization roles.

The function doesn't verify if the supplied `baseURI_` is a valid IPFS location.

The linked variables assigned in the constructor can be declared as `immutable`. Immutable state variables can be assigned during contract creation but will remain constant throughout the lifetime of a deployed contract. A big advantage of immutable variables is that reading them is significantly cheaper than reading from regular state variables since they will not be stored in storage.

Performing integer division before multiplication truncates the low bits, losing the precision of calculation. ```solidity=235 rewardRate = reward.div(DURATION); ``` ```solidity=238 uint256 leftover = remaining.mul(rewardRate); ``` --- ```solidity=649 block_slope = (MULTIPLIER * (block.number - last_point.blk)) / (block.timestamp - last_point.ts); ``` ```solidity=679 last_point.blk = initial_last_point.blk + (block_slope * (t_i - initial_last_point.ts)) / MULTIPLIER; ``` --- ```solidity=778 _bonusPercent = minBonusPercent + ((maxBonusPercent - minBonusPercent)*(_bonusTime*PRECISSION/maxBonusTime))/PRECISSION; ``` --- ```solidity=100 uint _amountPerNFT = totalAirdrop/_totalSupply; ``` ```solidity=101 uint _amount = _ogMints * _amountPerNFT; ``` --- ```solidity=119 uint claimablePercent = (timeElapsedSinceStart*PRECISION)/VESTING_PERIOD; ``` ```solidity=121 userInfo.CHRClaimable = _totalCHR*claimablePercent/PRECISION - claimedCHR[_who]; ```

It is expected that calls of the form `transfer(recipient, amount)` and `transferFrom(from, dest, amount)` fail if the recipient address is zero address.

The contract `AirdropClaimChrNFT` imports `IERC20` interface from openzeppelin, however the contract `VotingEscrow` imports the same interface from "./interfaces/IERC20.sol". Thus, compiling contracts encounters an error: "DeclarationError: Identifier already declared.".

When transferring deflationary ERC20 tokens, the input amount may not be equal to the received amount due to the charged transaction fee. For example, if a user sends 100 deflationary tokens (with a 10% transaction fee), only 90 tokens actually arrived to the contract. However, a failure to discount such fees may allow the same user to withdraw 100 tokens from the contract, which causes the contract to lose 10 tokens in such a transaction. Reference: https://thoreum-finance.medium.com/what-exploit-happened-today-for-gocerberus-and-garuda-also-for-lokum-ybear-piggy-caramelswap-3943ee23a39f ```solidity=225 IERC20(_rewardsToken).safeTransferFrom(msg.sender,address(this),reward); ``` - Transferring tokens by `reward`. ```solidity=235 rewardData[_rewardsToken][_startTimestamp].rewardsPerEpoch = _lastReward + reward; ``` - The `reward` appears to be used for bookkeeping purposes without compensating the potential transfer fees. --- ```solidity=156 _deposit(amount, msg.sender); ``` - Transferring tokens by `amount`. - This function call executes the following operation. - In `GaugeV2._deposit`, - `TOKEN.safeTransferFrom(account, address(this), amount);` ```solidity=156 _deposit(amount, msg.sender); ``` - This function call executes the following operation. - In `GaugeV2._deposit`, - `_totalSupply = _totalSupply.add(amount);` - In `SafeMath.add`, - `return a + b;` - The `amount` appears to be used for bookkeeping purposes without compensating the potential transfer fees. --- ```solidity=232 rewardToken.safeTransferFrom(DISTRIBUTION, address(this), reward); ``` - Transferring tokens by `reward`. ```solidity=239 rewardRate = reward.add(leftover).div(DURATION); ``` - This function call executes the following operation. - In `SafeMath.add`, - `return a + b;` - The `reward` appears to be used for bookkeeping purposes without compensating the potential transfer fees. --- ```solidity=809 assert(IERC20(token).transferFrom(from, address(this), _value)); ``` - Transferring tokens by `_value`. ```solidity=819 emit Supply(supply_before, supply_before + _value); ``` - The `_value` appears to be used for bookkeeping purposes without compensating the potential transfer fees. --- ```solidity=842 _deposit_for(_tokenId, _value, 0, _locked, DepositType.DEPOSIT_FOR_TYPE); ``` - Transferring tokens by `_value`. - This function call executes the following operation. - In `VotingEscrow._deposit_for`, - `assert(IERC20(token).transferFrom(from, address(this), _value));` ```solidity=842 _deposit_for(_tokenId, _value, 0, _locked, DepositType.DEPOSIT_FOR_TYPE); ``` - This function call executes the following operation. - In `VotingEscrow._deposit_for`, - `emit Supply(supply_before, supply_before + _value);` - The `_value` appears to be used for bookkeeping purposes without compensating the potential transfer fees. --- ```solidity=860 _deposit_for(_tokenId, _value, unlock_time, locked[_tokenId], DepositType.CREATE_LOCK_TYPE); ``` - Transferring tokens by `_value`. - This function call executes the following operation. - In `VotingEscrow._deposit_for`, - `assert(IERC20(token).transferFrom(from, address(this), _value));` ```solidity=860 _deposit_for(_tokenId, _value, unlock_time, locked[_tokenId], DepositType.CREATE_LOCK_TYPE); ``` - This function call executes the following operation. - In `VotingEscrow._deposit_for`, - `emit Supply(supply_before, supply_before + _value);` - The `_value` appears to be used for bookkeeping purposes without compensating the potential transfer fees. --- ```solidity=869 return _create_lock(_value, _lock_duration, msg.sender); ``` - Transferring tokens by `_value`. - This function call executes the following operation. - In `VotingEscrow._create_lock`, - `_deposit_for(_tokenId, _value, unlock_time, locked[_tokenId], DepositType.CREATE_LOCK_TYPE);` - In `VotingEscrow._deposit_for`, - `assert(IERC20(token).transferFrom(from, address(this), _value));` ```solidity=869 return _create_lock(_value, _lock_duration, msg.sender); ``` - This function call executes the following operation. - In `VotingEscrow._create_lock`, - `_deposit_for(_tokenId, _value, unlock_time, locked[_tokenId], DepositType.CREATE_LOCK_TYPE);` - In `VotingEscrow._deposit_for`, - `emit Supply(supply_before, supply_before + _value);` - The `_value` appears to be used for bookkeeping purposes without compensating the potential transfer fees. --- ```solidity=877 return _create_lock(_value, _lock_duration, _to); ``` - Transferring tokens by `_value`. - This function call executes the following operation. - In `VotingEscrow._create_lock`, - `_deposit_for(_tokenId, _value, unlock_time, locked[_tokenId], DepositType.CREATE_LOCK_TYPE);` - In `VotingEscrow._deposit_for`, - `assert(IERC20(token).transferFrom(from, address(this), _value));` ```solidity=877

The function `createPair` can be called by anyone as it has no access restriction. This enables anyone to call this and create a swap pair. In addition, there isn't a whitelist to control swap token types. The swap pool does not support deflationary tokens, users may create a swap pool for deflationary tokens by mistake. Furthermore, malicious users may create swap pools for scam tokens.

The `_transfer` function lacks a check to ensure the token sender has sufficient balance. Therefore, if the sender's balance is insufficient, the token transfer process will be reverted with the error message "Arithmetic over/underflow", which does not accurately describe the issue.

The contract is serving as the underlying entity to interact with one or more third party protocols. The scope of the audit treats third party entities as black boxes and assume their functional correctness. However, in the real world, third parties can be compromised and this may lead to lost or stolen assets. In addition, upgrades of third parties can possibly create severe impacts, such as increasing fees of third parties, migrating to new LP pools, etc. ```solidity=38 address public gaugeRewarder; ``` - The contract `GaugeV2` interacts with third party contract with `IRewarder` interface via `gaugeRewarder`. --- ```solidity=38 IRewardsDistributor public _rewards_distributor; ``` - The contract `MinterUpgradeable` interacts with third party contract with `IRewardsDistributor` interface via `_rewards_distributor`. --- ```solidity=35 address public immutable token0; ``` - The contract `Pair` interacts with third party contract with `IERC20` interface via `token0`. --- ```solidity=36 address public immutable token1; ``` - The contract `Pair` interacts with third party contract with `IERC20` interface via `token1`.