Skip to content
$1,000,000 in security audit grants are live now, Apply here →

Security review · January 2025

CauldronFeeWithdrawer for SpellPower Staking

for Abracadabra Money

Guardian's review of CauldronFeeWithdrawer for SpellPower Staking for Abracadabra Money, published January 2025. The report records 6 findings, including 6 low.

Published
Review window
January 2 to 8, 2025
Language
Solidity
Chains
Ethereum, Arbitrum
Sector
Lending, Staking
  • 0 Critical
  • 0 High
  • 0 Medium
  • 6 Low
  • 0 Informational

4 resolved · 2 acknowledged

Scope

Findings 6

  1. L-01 Low Unused Error Optimization Resolved

    Description

    In the CauldronFeeWithdrawer contract the ErrNotRegistered error is unused.

    Recommendation

    Implement the corresponding cauldron validation in the withdraw function or remove the ErrNotRegistered error.

  2. L-02 Low Missing Fee Collector Check Validation Acknowledged

    Description

    In the distribute function the treasury share of mim rewards is transferred to the feeCollector even if the feeCollector has not yet been assigned. This introduces the risk of sending the treasury fees to the zero address if the system is not initialized properly.

    Recommendation

    Consider changing the if (treasuryAmount > 0) validation to if (treasuryAmount > 0 && feeCollector != address(0)). Any mim left in the CauldronFeeWithdrawer contract after failing this check that should go to the treasury can be withdrawn with the execute function calling the mim contract directly.

  3. L-03 Low Unused _cauldronPredicate function Warning Resolved

    Description

    In the CauldronFeeWithdrawer deployment script there is an unused _cauldronPredicate function.

    Recommendation

    Implement the use case for the _cauldronPredicate or consider removing it.

  4. L-04 Low Upgradeable Friendly Contracts Are Not Used Best Practices Acknowledged

    Description

    The CauldronFeeWithdrawer contract is a UUPS upgradeable contract, however there are contracts which are not upgradeable friendly which the CauldronFeeWithdrawer inherits from. The FeeCollectable and OwnableOperators contracts include storage variables that do not use namespaced storage nor include a storage gap at the end. As a result if an upgrade takes place and the storage layout of either of the FeeCollectable and OwnableOperators contracts is changed this can result in unexpected storage issues.

    Recommendation

    Since the FeeCollectable and OwnableOperators contracts are already used in tandem with other contracts which might be upgradeable, it is sensitive to update them and potentially accidentally change the storage layout of those proxy contracts in an unexpected way. Instead just note this behavior and exercise caution when initiating any upgrades.

  5. L-05 Low Staking Contract Is Not Configured Configuration Resolved

    Description

    In the CauldronFeeWithdrawer script there is no configuration of the staking contract.

    Recommendation

    Consider adding logic to configure the staking contract for the Arbitrum deployment of the CauldronFeeWithdrawer contract.

  6. L-06 Low Unnecessary Owner Initialization Superfluous Code Resolved

    Description

    In the constructor for the CauldronFeeWithdrawer the _initializeOwner function is called, however it is unnecessary to assign an owner for the implementation contract. Furthermore the owner is assigned as the zero address in the deployment script, meaning that this function does not update any storage and instead merely emits the OwnershipTransferred event.

    Recommendation

    Remove the _initializeOwner call from the CauldronFeeWithdrawer constructor.

More from Abracadabra Money

All 19 reports
  1. MagicGLP Upgrade

    11 findings1 high 11 findings: 1 high, 10 low
  2. PurrSwap Aerodrome

    105 findings9 high 105 findings: 9 high, 23 medium, 45 low, 28 informational
  3. PurrSwap ve33

    74 findings5 critical · 10 high 74 findings: 5 critical, 10 high, 20 medium, 39 low
  4. Hyperliquid OFT Deployment

    3 findings 3 findings: 1 low, 2 informational

Put your code through the same review.

This review started with a conversation about scope. Tell us what you are building and we will plan yours with you.

Get a quote