Steadefi Documentation

/

/

/

Codehawks Public Audit Mitigation Report

L-02. Lack of events for critical actions

Submitted by Timenov, hunterw3b, Kodak, SBSecurity, Fides, mylifechangefast, SanketKogekar. Selected submission by: SBSecurity.

Relevant GitHub Links

https://github.com/Cyfrin/2023-10-SteadeFi/blob/0f909e2f0917cb9ad02986f631d622376510abec/contracts/strategy/gmx/GMXDeposit.sol#L161

https://github.com/Cyfrin/2023-10-SteadeFi/blob/0f909e2f0917cb9ad02986f631d622376510abec/contracts/strategy/gmx/GMXCompound.sol#L35

https://github.com/Cyfrin/2023-10-SteadeFi/blob/0f909e2f0917cb9ad02986f631d622376510abec/contracts/strategy/gmx/GMXEmergency.sol#L72

https://github.com/Cyfrin/2023-10-SteadeFi/blob/0f909e2f0917cb9ad02986f631d622376510abec/contracts/strategy/gmx/GMXManager.sol#L225

https://github.com/Cyfrin/2023-10-SteadeFi/blob/0f909e2f0917cb9ad02986f631d622376510abec/contracts/strategy/gmx/GMXManager.sol#L244

https://github.com/Cyfrin/2023-10-SteadeFi/blob/0f909e2f0917cb9ad02986f631d622376510abec/contracts/strategy/gmx/GMXRebalance.sol#L35

https://github.com/Cyfrin/2023-10-SteadeFi/blob/0f909e2f0917cb9ad02986f631d622376510abec/contracts/strategy/gmx/GMXRebalance.sol#L149

https://github.com/Cyfrin/2023-10-SteadeFi/blob/0f909e2f0917cb9ad02986f631d622376510abec/contracts/strategy/gmx/GMXVault.sol#L334

https://github.com/Cyfrin/2023-10-SteadeFi/blob/0f909e2f0917cb9ad02986f631d622376510abec/contracts/strategy/gmx/GMXWithdraw.sol#L231

https://github.com/Cyfrin/2023-10-SteadeFi/blob/0f909e2f0917cb9ad02986f631d622376510abec/contracts/strategy/gmx/GMXWorker.sol#L23

https://github.com/Cyfrin/2023-10-SteadeFi/blob/0f909e2f0917cb9ad02986f631d622376510abec/contracts/strategy/gmx/GMXWorker.sol#L72

https://github.com/Cyfrin/2023-10-SteadeFi/blob/0f909e2f0917cb9ad02986f631d622376510abec/contracts/strategy/gmx/GMXWorker.sol#L114

https://github.com/Cyfrin/2023-10-SteadeFi/blob/0f909e2f0917cb9ad02986f631d622376510abec/contracts/strategy/gmx/GMXWorker.sol#L129

Summary

There are functions that don’t emit events.

Vulnerability Details

Functions:

GMXDeposit::processDepositFailure

GMXCompound::compound

GMXEmergency::emergencyResume

GMXManager::borrow

GMXManager::repay

GMXRebalance::rebalanceAdd

GMXRebalance::rebalanceRemove

GMXVault::mintFee

GMXWithdraw::processWithdrawFailure

GMXWorker::addLiquidity

GMXWorker::removeLiquidity

GMXWorker::swapExactTokensForTokens

GMXWorker::swapTokensForExactTokens

Impact

External users, frontend, or blockchain monitoring won’t announce for these critical functions.

Tools Used

Manual

Recommendations

Add events where possible for critical operations.

M-27. Missing fees allow cheap griefing attacks that lead to DoS

L-07. getsAmountsIn in GMXOracle hardcoded 15e14(15bps) for amountsIn would gives wrong amountsIn since GMX market has dynamic impact fee

Powered by Notaku

Helpful?

Content

L-02. Lack of events for critical actions

Relevant GitHub Links

Vulnerability Details

Recommendations