QA Report

[code423n4]

Lack of empty address checks

The following methods have a lack checks if the received argument is an address, it's good practice in order to reduce human error to check that the address specified in the constructor or initialize is different than address(0).

Source code:

• AuraMinter.sol#L21-L22
• AuraMerkleDrop.sol#L62-L66
• AuraPenaltyForwarder.sol#L35-L36
• ClaimFeesHelper.sol#L37
• BalLiquidityProvider.sol#L34-L39
• CrvDepositorWrapper.sol#L45-L46
• CrvDepositorWrapper.sol#L114
• AuraVestedEscrow.sol#L59-L61
• AuraStakingProxy.sol#L74-L79
• ExtraRewardsDistributor.sol#L37
• AuraBalRewardPool.sol#L70-L74
• AuraClaimZap.sol#L76-L81
• AuraLocker.sol#L158-L160

As stated in the OpenZeppelin source comments, the OpenZeppeling ERC20 safeApprove() function has been deprecated.

Using this deprecated function could result in accidental reverts and possibly fund locking. The deprecation of this function is discussed in greater depth in the OZ issue #2219.

As suggested by the OpenZeppelin comment, replace safeApprove() with safeIncreaseAllowance() or safeDecreaseAllowance() instead.

Source code:

• AuraMerkleDrop.sol#L131-L132
• AuraPenaltyForwarder.sol#L41
• BalLiquidityProvider.sol#L59-L60
• CrvDepositorWrapper.sol#L52-L53
• CrvDepositorWrapper.sol#L119
• AuraVestedEscrow.sol#L186
• AuraStakingProxy.sol#L147-L151
• AuraStakingProxy.sol#L216
• AuraBalRewardPool.sol#L75
• AuraClaimZap.sol#L98-L105
• AuraLocker.sol#L241

Unsecure Ownership change

The modification of an owner is a delicate procedure, as it may jeopardize the governance of our contract and therefore the project. As a result, it is advised that the owner's modification logic be changed to one that allows for verification that the new owner is valid and exists.

It is required to establish a logic for the owner's modification in which a new owner is proposed first, the owner approves the suggestion, and we ensure that the new owner's address is written correctly.

Source code:

• AuraVestedEscrow.sol#L77

Reentrancy pattern

Although it has not been possible to exploit the reentrancy attack, the logic of the methods named below, make the changes of the validation flags after a method that allows reentrancy, it is convenient to modify the flags before the external calls to contracts.

Source code:

• AuraVestedEscrow.sol#L125