QA Report

[code423n4]

QA Report

File AuraLocker.sol

Unlocked pragma

Contracts should be deployed using the same compiler version/flags with which they have been tested. Locking the pragma (for e.g. by not using ^ in pragma solidity 0.5.10) ensures that contracts do not accidentally get deployed using an older compiler version with unfixed bugs.

L2

Mistake in comment

// User -> reward token -> amount
Should be
// User -> reward token -> userData
L78

Out possible lock by out of gas

If the loop in the modifier has to loop througt many rewardTokens the contract could end lockup

L173-L183

Avoid != on loop comparission

Source: https://github.com/crytic/slither/wiki/Detector-Documentation#dangerous-strict-equalities

recommendation
while (epochs[epochs.length - 1].date != currentEpoch) {
Change to:
while (epochs[epochs.length - 1].date < currentEpoch) {

L334

Critical functions dont emit events

Consider add events on this functions
addReward
approveRewardDistributor

File AuraBalRewardPool.sol

Unlocked pragma

Contracts should be deployed using the same compiler version/flags with which they have been tested. Locking the pragma (for e.g. by not using ^ in pragma solidity 0.5.10) ensures that contracts do not accidentally get deployed using an older compiler version with unfixed bugs.

L2

File AuraVestedEscrow.sol

Unlocked pragma

Contracts should be deployed using the same compiler version/flags with which they have been tested. Locking the pragma (for e.g. by not using ^ in pragma solidity 0.5.10) ensures that contracts do not accidentally get deployed using an older compiler version with unfixed bugs.

L2

Assert that array length match

current code

    function fund(address[] calldata _recipient, uint256[] calldata _amount) external nonReentrant {

Consider add

    function fund(address[] calldata _recipient, uint256[] calldata _amount) external nonReentrant {
      assert(_recipient.length == _amount.length, "Array length mismatch");

https://github.com/code-423n4/2022-05-aura/blob/a8758161373bc9c9ad2aec363b511afa3ed0613f/contracts/AuraVestedEscrow.sol#L96-L99

Critical functions dont emit events

Consider add events on this functions
setAdmin
setLocker

file Booster.sol

Assert that array length match

current code

    function voteGaugeWeight(address[] calldata _gauge, uint256[] calldata _weight ) external returns(bool){
        require(msg.sender == voteDelegate, "!auth");

Consider add

    function voteGaugeWeight(address[] calldata _gauge, uint256[] calldata _weight ) external returns(bool){
        require(msg.sender == voteDelegate, "!auth");
        require(_gauge.length == _weight.length, "array length mistmatch");

https://github.com/code-423n4/2022-05-aura/blob/main/convex-platform/contracts/contracts/Booster.sol#L535-L536

File VoterProxy.sol

Critical functions dont emit events

Consider add events on this functions
setOwner
setRewardDeposit
setSystemConfig
setOperator
setDepositor
setStashAccess
withdraw

File CrvDepositor.sol

Critical functions dont emit events

Consider add events on this functions
setFeeManager
setDaoOperator
setFees
setCooldown
[depositFor]https://github.com/code-423n4/2022-05-aura/blob/main/convex-platform/contracts/contracts/CrvDepositor.sol#L168

[0xMaharishi]

Some nice reports here, will consider resolving some.