Sign Up for a Code Audit Today and Get 3 Months of Skynet for Free

The functionality of this project can be divided into two pieces.

**HauntedHouse**
1. Users can deposit their assets to the `HauntedHouse` contract to get the regular zBOOFI token rewards.
2. The `HauntedHouse` invested tokens users deposited to different third-party contracts to get rewards through `Strategy` contract.
3. Users can get back the tokens they pledged in the contract and have to pay a fee.
4. Users can reap the rewards of tokens generated by the contract on a regular basis.

**Staking**
1. Users can stake their zBOOFI tokens to the contract `zBOOFI_Staking`.
2. The `BOOFI_Distributor` will distributor the BooFI tokens as rewards to the `zBOOFI_Staking`.
3. Users can harvest their rewards and the top 10 can get the extra rewards.
4. Users can withdraw their tokens from the `zBOOFI_Staking`.

**Warning**
1. The rewards `HauntedHouse` get from investing will be transferred to a `StrategyPool`. The exact distribution of rewards is not known from the code.
2. When users want to exchange the zBooFI token for the BooFI token, the users may pay some fees. The fee rate is rated to the total amount of tokens withdrawn in the last three days. The biggest rate may come to 25% if too many tokens are withdrawn.

Financial Models

In the contract `BOOFI` the role `_owner` has authority over the functions shown in the diagram below.

Any compromise to the `_owner` account may allow the hacker to take advantage of this authority.

![](https://accelerator-tasks-prod.s3.amazonaws.com/0ba47ddad6d14b37a1dab9268b739efa/diagrams/centralization-BOOFI-_owner.svg)

In the contract `BOOFI_Distributor` the role `_owner` has authority over the functions shown in the diagram below.

Any compromise to the `_owner` account may allow the hacker to take advantage of this authority.

![](https://accelerator-tasks-prod.s3.amazonaws.com/0ba47ddad6d14b37a1dab9268b739efa/diagrams/centralization-BOOFI_Distributor-_owner.svg)

In the contract `ERC20AndAvaxDistributorAdjustableBips` the role `_owner` has authority over the functions shown in the diagram below.

Any compromise to the `_owner` account may allow the hacker to take advantage of this authority.

![](https://accelerator-tasks-prod.s3.amazonaws.com/0ba47ddad6d14b37a1dab9268b739efa/diagrams/centralization-ERC20AndAvaxDistributorAdjustableBips-_owner.svg)

In the contract `ERC20DistributorAdjustableBips` the role `_owner` has authority over the functions shown in the diagram below.

Any compromise to the `_owner` account may allow the hacker to take advantage of this authority.

![](https://accelerator-tasks-prod.s3.amazonaws.com/0ba47ddad6d14b37a1dab9268b739efa/diagrams/centralization-ERC20DistributorAdjustableBips-_owner.svg)

In the contract `HauntedHouse` the role `_owner` has authority over the functions shown in the diagram below.

Any compromise to the `_owner` account may allow the hacker to take advantage of this authority.

![](https://accelerator-tasks-prod.s3.amazonaws.com/0ba47ddad6d14b37a1dab9268b739efa/diagrams/centralization-HauntedHouse-_owner.svg)

In the contract `HauntedHouse` the role `approvedContracts` has authority over the functions shown in the diagram below.

Any compromise to the `approvedContracts` account may allow the hacker to take advantage of this authority.

![](https://accelerator-tasks-prod.s3.amazonaws.com/0ba47ddad6d14b37a1dab9268b739efa/diagrams/centralization-HauntedHouse-approvedContracts.svg)

In the contract `HauntedHouse` the role `priceUpdater` has authority over the functions shown in the diagram below.

Any compromise to the `priceUpdater` account may allow the hacker to take advantage of this authority.

![](https://accelerator-tasks-prod.s3.amazonaws.com/0ba47ddad6d14b37a1dab9268b739efa/diagrams/centralization-HauntedHouse-priceUpdater.svg)

In the contract `HauntedHouse` the role `roles` has authority over the functions shown in the diagram below.

Any compromise to the `roles` account may allow the hacker to take advantage of this authority.

![](https://accelerator-tasks-prod.s3.amazonaws.com/0ba47ddad6d14b37a1dab9268b739efa/diagrams/centralization-HauntedHouse-roles.svg)

In the contract `Ownable` the role `_owner` has authority over the functions shown in the diagram below.

Any compromise to the `_owner` account may allow the hacker to take advantage of this authority.

![](https://accelerator-tasks-prod.s3.amazonaws.com/0ba47ddad6d14b37a1dab9268b739efa/diagrams/centralization-Ownable-_owner.svg)

In the contract `TWAP_Oracle` the role `_owner` has authority over the functions shown in the diagram below.

Any compromise to the `_owner` account may allow the hacker to take advantage of this authority.

![](https://accelerator-tasks-prod.s3.amazonaws.com/0ba47ddad6d14b37a1dab9268b739efa/diagrams/centralization-TWAP_Oracle-_owner.svg)

In the contract `Timelock` the role `admin` has authority over the functions shown in the diagram below.

Any compromise to the `admin` account may allow the hacker to take advantage of this authority.

![](https://accelerator-tasks-prod.s3.amazonaws.com/0ba47ddad6d14b37a1dab9268b739efa/diagrams/centralization-Timelock-admin.svg)

In the contract `Timelock` the role `pendingAdmin` has authority over the functions shown in the diagram below.

Any compromise to the `pendingAdmin` account may allow the hacker to take advantage of this authority.

![](https://accelerator-tasks-prod.s3.amazonaws.com/0ba47ddad6d14b37a1dab9268b739efa/diagrams/centralization-Timelock-pendingAdmin.svg)

In the contract `TopHarvestersDistributor` the role `_owner` has authority over the functions shown in the diagram below.

Any compromise to the `_owner` account may allow the hacker to take advantage of this authority.

![](https://accelerator-tasks-prod.s3.amazonaws.com/0ba47ddad6d14b37a1dab9268b739efa/diagrams/centralization-TopHarvestersDistributor-_owner.svg)

In the contract `ZombieBOOFI` the role `_owner` has authority over the functions shown in the diagram below.

Any compromise to the `_owner` account may allow the hacker to take advantage of this authority.

![](https://accelerator-tasks-prod.s3.amazonaws.com/0ba47ddad6d14b37a1dab9268b739efa/diagrams/centralization-ZombieBOOFI-_owner.svg)

In the contract `zBOOFI_Staking` the role `_owner` has authority over the functions shown in the diagram below.

Any compromise to the `_owner` account may allow the hacker to take advantage of this authority.

![](https://accelerator-tasks-prod.s3.amazonaws.com/0ba47ddad6d14b37a1dab9268b739efa/diagrams/centralization-zBOOFI_Staking-_owner.svg)

In the contract `zBOOFI_WithdrawalFeeCalculator` the role `_owner` has authority over the functions shown in the diagram below.

Any compromise to the `_owner` account may allow the hacker to take advantage of this authority.

![](https://accelerator-tasks-prod.s3.amazonaws.com/0ba47ddad6d14b37a1dab9268b739efa/diagrams/centralization-zBOOFI_WithdrawalFeeCalculator-_owner.svg)

In the contract `BoofiStrategyBase` the role `_owner` has authority over the functions shown in the diagram below.

Any compromise to the `_owner` account may allow the hacker to take advantage of this authority.

![](https://accelerator-tasks-prod.s3.amazonaws.com/0ba47ddad6d14b37a1dab9268b739efa/diagrams/centralization-BoofiStrategyBase-_owner.svg)

In the contract `BoofiStrategyForCTokenStaking` the role `_owner` has authority over the functions shown in the diagram below.

Any compromise to the `_owner` account may allow the hacker to take advantage of this authority.

![](https://accelerator-tasks-prod.s3.amazonaws.com/0ba47ddad6d14b37a1dab9268b739efa/diagrams/centralization-BoofiStrategyForCTokenStaking-_owner.svg)

In the contract `BoofiStrategyForDexStaking` the role `_owner` has authority over the functions shown in the diagram below.

Any compromise to the `_owner` account may allow the hacker to take advantage of this authority.

![](https://accelerator-tasks-prod.s3.amazonaws.com/0ba47ddad6d14b37a1dab9268b739efa/diagrams/centralization-BoofiStrategyForDexStaking-_owner.svg)

In the contract `BoofiStrategyForDexStakingMultiRewards` the role `_owner` has authority over the functions shown in the diagram below.

Any compromise to the `_owner` account may allow the hacker to take advantage of this authority.

![](https://accelerator-tasks-prod.s3.amazonaws.com/0ba47ddad6d14b37a1dab9268b739efa/diagrams/centralization-BoofiStrategyForDexStakingMultiRewards-_owner.svg)

In the contract `BoofiStrategyForJoeLending` the role `_owner` has authority over the functions shown in the diagram below.

Any compromise to the `_owner` account may allow the hacker to take advantage of this authority.

![](https://accelerator-tasks-prod.s3.amazonaws.com/0ba47ddad6d14b37a1dab9268b739efa/diagrams/centralization-BoofiStrategyForJoeLending-_owner.svg)

In the contract `BoofiStrategyForQiStaking` the role `_owner` has authority over the functions shown in the diagram below.

Any compromise to the `_owner` account may allow the hacker to take advantage of this authority.

![](https://accelerator-tasks-prod.s3.amazonaws.com/0ba47ddad6d14b37a1dab9268b739efa/diagrams/centralization-BoofiStrategyForQiStaking-_owner.svg)

In the contract `BoofiStrategyForQiStaking_WAVAX` the role `_owner` has authority over the functions shown in the diagram below.

Any compromise to the `_owner` account may allow the hacker to take advantage of this authority.

![](https://accelerator-tasks-prod.s3.amazonaws.com/0ba47ddad6d14b37a1dab9268b739efa/diagrams/centralization-BoofiStrategyForQiStaking_WAVAX-_owner.svg)

In the contract `CauldronPriceUpdater` the role `_owner` has authority over the functions shown in the diagram below.

Any compromise to the `_owner` account may allow the hacker to take advantage of this authority.

![](https://accelerator-tasks-prod.s3.amazonaws.com/0ba47ddad6d14b37a1dab9268b739efa/diagrams/centralization-CauldronPriceUpdater-_owner.svg)

In the contract `CauldronPriceUpdater` the role `whitelist` has authority over the functions shown in the diagram below.

Any compromise to the `whitelist` account may allow the hacker to take advantage of this authority.

![](https://accelerator-tasks-prod.s3.amazonaws.com/0ba47ddad6d14b37a1dab9268b739efa/diagrams/centralization-CauldronPriceUpdater-whitelist.svg)

Centralization Risks

The `strategy` contracts are serving as the underlying entity to interact with third parties. These contracts use tokens pledged by users to `HauntedHouse` to invest. The user's tokens are pledged to third-party contracts to receive rewards. And the rewards will be swapped to the `Boofi` tokens by the third-party contracts. The scope of the audit treats 3rd party contracts as black boxes and assumes their functional correctness. 

The `HauntedHouse` contract is serving as the underlying entity to interact with the third-party contract `Rewarder` to call the function `onZBoofiReward()`.

However, in the real world, 3rd parties can be compromised and this may lead to lost or stolen assets. In addition, upgrades of 3rd parties can possibly create severe impacts, such as increasing fees of 3rd parties, migrating to new LP pools, etc.

Third Party Dependencies

The strategy contracts give some third-party contracts the unlimited allowance. This will cause the transaction function to skip the allowance checksum. This could potentially cause the transaction to be insecure.

Potentially Dangerous Allowance

The function `deposit()` adds a new staking before claiming the reward. This may cause the newly added staking token to receive an additional reward.

Staking Before Claiming Rewards

In the contract `CauldronPriceUpdater.sol`, the role `owner` has the power to set the address of `oracle`.

Any compromise on the `owner` account could allow a hacker to use this power and change the address of `oracle` to manipulate prices.

Centralization Related Risks

The fallback function can only rely on 2300 gas being available (for example when sending or transfer is used), the calling of the `defaultSplit()` function in the fallback function will cost more than 2300 gas and more extra gas is required. Is that designed as expected? (https://docs.soliditylang.org/en/v0.5.8/contracts.html#fallback-function)

Potential Out-of-Gas Exception

In contracts `HauntedHouse`, `HauntedHouseAvaxDepositHelper` and `BoofiStrategyForCTokenStaking`, we understand modifier `onlyApprovedContractOrEOA` is necessary to avoid flash loan attacks. Please keep in mind that the line of code `msg.sender == tx.origin` would be potentially deprecated if EIP-3074 passed.

Currently, EIP-3074 is still in review status and there are no clear signals of passing or not. Strongly recommend monitoring the status of EIP-3074, and upgrading the contract before the Ethereum update, if it passes.

Refer to the Ethereum improvement proposals page `https://eips.ethereum.org/EIPS/eip-3074`.

Warning on EIP-3074

The variable `globalCumulativeAverage` has been updated, but never accessed

Redundant Statements

The lower limit of delay time may be too short.

Delay Time Too Short

BooFinance

BOOFI_Distributor.sol

BoofiStrategyBase.sol

BoofiStrategyForDexStaking.sol

staking

zBOOFI_WithdrawalFeeCalculator.sol

TWAP_Oracle.sol

ERC20WithVoting.sol

TopHarvestersDistributor.sol

BOOFI.sol

HauntedHouseAvaxDepositHelper.sol

ERC20WithVotingAndPermit.sol

CauldronPriceUpdater.sol

distributors

BoofiStrategyForJoeLending.sol

BoofiStrategyForPangolinMiniChefStaking.sol

strategies

BoofiStrategyForCTokenStaking.sol

tokens

ERC20AndAvaxDistributorAdjustableBips.sol

BoofiStrategyForJoeV2Staking.sol

zBOOFI_Staking.sol

BoofiStrategyForLydiaStaking.sol

BoofiStrategyForQiStaking_WAVAX.sol

TokenOrAvaxTransfer.sol

BoofiStrategyForPangolinStaking.sol

ERC20AndAvaxDistributor.sol

HauntedHouse.sol

BoofiStrategyForJoeV3Staking.sol

ZombieBOOFI.sol

zBOOFI_Staking_Helper.sol

Timelock.sol

BoofiStrategyForDexStakingMultiRewards.sol

BoofiStrategyForQiStaking.sol

ERC20DistributorAdjustableBips.sol

ERC20Distributor.sol

BooFinance 

BooFinance

Highlights & Alerts

This is just a placeholder

highlight placeholder lorem Ipsum...

highlight lorem

This is a alert demo

Alert demo

Code Audit History

10

0

8

2

0