Guardian's review of CauldronFeeWithdrawer for SpellPower Staking for Abracadabra Money, published January 2025. The report records 6 findings, including 6 low.
- Published
- Review window
- January 2 to 8, 2025
- Language
- Solidity
- Chains
- Ethereum, Arbitrum
- Sector
- Lending, Staking
- 0 Critical
- 0 High
- 0 Medium
- 6 Low
- 0 Informational
Scope
Findings 6
-
L-01 Low Unused Error Optimization Resolved
Description
In the
CauldronFeeWithdrawercontract theErrNotRegisterederror is unused.Recommendation
Implement the corresponding cauldron validation in the
withdrawfunction or remove theErrNotRegisterederror. -
L-02 Low Missing Fee Collector Check Validation Acknowledged
Description
In the
distributefunction the treasury share of mim rewards is transferred to thefeeCollectoreven if thefeeCollectorhas not yet been assigned. This introduces the risk of sending the treasury fees to the zero address if the system is not initialized properly.Recommendation
Consider changing the
if (treasuryAmount > 0)validation toif (treasuryAmount > 0 && feeCollector != address(0)). Any mim left in theCauldronFeeWithdrawercontract after failing this check that should go to the treasury can be withdrawn with theexecutefunction calling the mim contract directly. -
L-03 Low Unused _cauldronPredicate function Warning Resolved
Description
In the
CauldronFeeWithdrawerdeployment script there is an unused_cauldronPredicatefunction.Recommendation
Implement the use case for the
_cauldronPredicateor consider removing it. -
L-04 Low Upgradeable Friendly Contracts Are Not Used Best Practices Acknowledged
Description
The
CauldronFeeWithdrawercontract is a UUPS upgradeable contract, however there are contracts which are not upgradeable friendly which theCauldronFeeWithdrawerinherits from. TheFeeCollectableandOwnableOperatorscontracts include storage variables that do not use namespaced storage nor include a storage gap at the end. As a result if an upgrade takes place and the storage layout of either of theFeeCollectableandOwnableOperatorscontracts is changed this can result in unexpected storage issues.Recommendation
Since the
FeeCollectableandOwnableOperatorscontracts are already used in tandem with other contracts which might be upgradeable, it is sensitive to update them and potentially accidentally change the storage layout of those proxy contracts in an unexpected way. Instead just note this behavior and exercise caution when initiating any upgrades. -
L-05 Low Staking Contract Is Not Configured Configuration Resolved
Description
In the
CauldronFeeWithdrawerscript there is no configuration of the staking contract.Recommendation
Consider adding logic to configure the staking contract for the Arbitrum deployment of the
CauldronFeeWithdrawercontract. -
L-06 Low Unnecessary Owner Initialization Superfluous Code Resolved
Description
In the constructor for the
CauldronFeeWithdrawerthe_initializeOwnerfunction is called, however it is unnecessary to assign an owner for the implementation contract. Furthermore the owner is assigned as the zero address in the deployment script, meaning that this function does not update any storage and instead merely emits theOwnershipTransferredevent.Recommendation
Remove the
_initializeOwnercall from theCauldronFeeWithdrawerconstructor.
No findings match.
More from Abracadabra Money
All 19 reports-
MagicGLP Upgrade
11 findings1 high 11 findings: 1 high, 10 low -
PurrSwap Aerodrome
105 findings9 high 105 findings: 9 high, 23 medium, 45 low, 28 informational -
PurrSwap ve33
74 findings5 critical · 10 high 74 findings: 5 critical, 10 high, 20 medium, 39 low -
Hyperliquid OFT Deployment
3 findings 3 findings: 1 low, 2 informational
Put your code through the same review.
This review started with a conversation about scope. Tell us what you are building and we will plan yours with you.
