From 9d0d109b5874a795e0801d01f88a6bee872d487d Mon Sep 17 00:00:00 2001 From: TilakMaddy Date: Fri, 18 Oct 2024 15:11:54 +0530 Subject: [PATCH] cli/reportgen --- reports/ccip-functions-report.md | 26 +----------- reports/templegold-report.md | 68 ++++---------------------------- 2 files changed, 8 insertions(+), 86 deletions(-) diff --git a/reports/ccip-functions-report.md b/reports/ccip-functions-report.md index 1a180b35..06397547 100644 --- a/reports/ccip-functions-report.md +++ b/reports/ccip-functions-report.md @@ -9,7 +9,6 @@ This report was generated by [Aderyn](https://github.com/Cyfrin/aderyn), a stati - [Issue Summary](#issue-summary) - [High Issues](#high-issues) - [H-1: Contract Name Reused in Different Files](#h-1-contract-name-reused-in-different-files) - - [H-2: Uninitialized State Variables](#h-2-uninitialized-state-variables) - [Low Issues](#low-issues) - [L-1: Centralization Risk for trusted owners](#l-1-centralization-risk-for-trusted-owners) - [L-2: `ecrecover` is susceptible to signature malleability](#l-2-ecrecover-is-susceptible-to-signature-malleability) @@ -104,7 +103,7 @@ This report was generated by [Aderyn](https://github.com/Cyfrin/aderyn), a stati | Category | No. of Issues | | --- | --- | -| High | 2 | +| High | 1 | | Low | 18 | @@ -433,29 +432,6 @@ When compiling contracts with certain development frameworks (for example: Truff -## H-2: Uninitialized State Variables - -Solidity does initialize variables by default when you declare them, however it's good practice to explicitly declare an initial value. For example, if you transfer money to an address we must make sure that the address has been initialized. - -
2 Found Instances - - -- Found in src/v0.8/functions/dev/v1_X/FunctionsSubscriptions.sol [Line: 39](../tests/ccip-contracts/contracts/src/v0.8/functions/dev/v1_X/FunctionsSubscriptions.sol#L39) - - ```solidity - uint64 private s_currentSubscriptionId; - ``` - -- Found in src/v0.8/functions/v1_0_0/FunctionsSubscriptions.sol [Line: 39](../tests/ccip-contracts/contracts/src/v0.8/functions/v1_0_0/FunctionsSubscriptions.sol#L39) - - ```solidity - uint64 private s_currentSubscriptionId; - ``` - -
- - - # Low Issues ## L-1: Centralization Risk for trusted owners diff --git a/reports/templegold-report.md b/reports/templegold-report.md index 26e01646..8309c215 100644 --- a/reports/templegold-report.md +++ b/reports/templegold-report.md @@ -11,10 +11,9 @@ This report was generated by [Aderyn](https://github.com/Cyfrin/aderyn), a stati - [H-1: Arbitrary `from` passed to `transferFrom` (or `safeTransferFrom`)](#h-1-arbitrary-from-passed-to-transferfrom-or-safetransferfrom) - [H-2: Unsafe Casting](#h-2-unsafe-casting) - [H-3: Contract Name Reused in Different Files](#h-3-contract-name-reused-in-different-files) - - [H-4: Uninitialized State Variables](#h-4-uninitialized-state-variables) - - [H-5: Weak Randomness](#h-5-weak-randomness) - - [H-6: Deletion from a nested mappping.](#h-6-deletion-from-a-nested-mappping) - - [H-7: Contract locks Ether without a withdraw function.](#h-7-contract-locks-ether-without-a-withdraw-function) + - [H-4: Weak Randomness](#h-4-weak-randomness) + - [H-5: Deletion from a nested mappping.](#h-5-deletion-from-a-nested-mappping) + - [H-6: Contract locks Ether without a withdraw function.](#h-6-contract-locks-ether-without-a-withdraw-function) - [Low Issues](#low-issues) - [L-1: Centralization Risk for trusted owners](#l-1-centralization-risk-for-trusted-owners) - [L-2: `ecrecover` is susceptible to signature malleability](#l-2-ecrecover-is-susceptible-to-signature-malleability) @@ -196,7 +195,7 @@ This report was generated by [Aderyn](https://github.com/Cyfrin/aderyn), a stati | Category | No. of Issues | | --- | --- | -| High | 7 | +| High | 6 | | Low | 28 | @@ -295,60 +294,7 @@ When compiling contracts with certain development frameworks (for example: Truff -## H-4: Uninitialized State Variables - -Solidity does initialize variables by default when you declare them, however it's good practice to explicitly declare an initial value. For example, if you transfer money to an address we must make sure that the address has been initialized. - -
7 Found Instances - - -- Found in contracts/amm/TempleUniswapV2Pair.sol [Line: 29](../tests/2024-07-templegold/protocol/contracts/amm/TempleUniswapV2Pair.sol#L29) - - ```solidity - uint public kLast; // reserve0 * reserve1, as of immediately after the most recent liquidity event - ``` - -- Found in contracts/fakes/templegold/TempleGoldStakingMock.sol [Line: 39](../tests/2024-07-templegold/protocol/contracts/fakes/templegold/TempleGoldStakingMock.sol#L39) - - ```solidity - uint256 public rewardPerTokenStored; - ``` - -- Found in contracts/fakes/templegold/TempleGoldStakingMock.sol [Line: 47](../tests/2024-07-templegold/protocol/contracts/fakes/templegold/TempleGoldStakingMock.sol#L47) - - ```solidity - uint256 public periodFinish; - ``` - -- Found in contracts/fakes/templegold/TempleGoldStakingMock.sol [Line: 48](../tests/2024-07-templegold/protocol/contracts/fakes/templegold/TempleGoldStakingMock.sol#L48) - - ```solidity - uint256 public lastUpdateTime; - ``` - -- Found in contracts/templegold/TempleGoldStaking.sol [Line: 40](../tests/2024-07-templegold/protocol/contracts/templegold/TempleGoldStaking.sol#L40) - - ```solidity - uint256 public override rewardPerTokenStored; - ``` - -- Found in contracts/templegold/TempleGoldStaking.sol [Line: 45](../tests/2024-07-templegold/protocol/contracts/templegold/TempleGoldStaking.sol#L45) - - ```solidity - uint256 public override periodFinish; - ``` - -- Found in contracts/templegold/TempleGoldStaking.sol [Line: 47](../tests/2024-07-templegold/protocol/contracts/templegold/TempleGoldStaking.sol#L47) - - ```solidity - uint256 public override lastUpdateTime; - ``` - -
- - - -## H-5: Weak Randomness +## H-4: Weak Randomness The use of keccak256 hash functions on predictable values like block.timestamp, block.number, or similar data, including modulo operations on these values, should be avoided for generating randomness, as they are easily predictable and manipulable. The `PREVRANDAO` opcode also should not be used as a source of randomness. Instead, utilize Chainlink VRF for cryptographically secure and provably random values to ensure protocol integrity. @@ -365,7 +311,7 @@ The use of keccak256 hash functions on predictable values like block.timestamp, -## H-6: Deletion from a nested mappping. +## H-5: Deletion from a nested mappping. A deletion in a structure containing a mapping will not delete the mapping. The remaining data may be used to compromise the contract. @@ -382,7 +328,7 @@ A deletion in a structure containing a mapping will not delete the mapping. The -## H-7: Contract locks Ether without a withdraw function. +## H-6: Contract locks Ether without a withdraw function. It appears that the contract includes a payable function to accept Ether but lacks a corresponding function to withdraw it, which leads to the Ether being locked in the contract. To resolve this issue, please implement a public or external function that allows for the withdrawal of Ether from the contract.