Read the findings of the 2022 Web3 Security Report

The functionality of this project can be divided into two pieces.

**HauntedHouse**
1. Users can deposit their assets to the `HauntedHouse` contract to get the regular zBOOFI token rewards.
2. The `HauntedHouse` invested tokens users deposited to different third-party contracts to get rewards through `Strategy` contract.
3. Users can get back the tokens they pledged in the contract and have to pay a fee.
4. Users can reap the rewards of tokens generated by the contract on a regular basis.

**Staking**
1. Users can stake their zBOOFI tokens to the contract `zBOOFI_Staking`.
2. The `BOOFI_Distributor` will distributor the BooFI tokens as rewards to the `zBOOFI_Staking`.
3. Users can harvest their rewards and the top 10 can get the extra rewards.
4. Users can withdraw their tokens from the `zBOOFI_Staking`.

**Warning**
1. The rewards `HauntedHouse` get from investing will be transferred to a `StrategyPool`. The exact distribution of rewards is not known from the code.
2. When users want to exchange the zBooFI token for the BooFI token, the users may pay some fees. The fee rate is rated to the total amount of tokens withdrawn in the last three days. The biggest rate may come to 25% if too many tokens are withdrawn.

Financial Models

In the contract `BOOFI` the role `_owner` has authority over the functions shown in the diagram below.

Any compromise to the `_owner` account may allow the hacker to take advantage of this authority.

![](https://accelerator-tasks-prod.s3.amazonaws.com/0ba47ddad6d14b37a1dab9268b739efa/diagrams/centralization-BOOFI-_owner.svg)

In the contract `BOOFI_Distributor` the role `_owner` has authority over the functions shown in the diagram below.

Any compromise to the `_owner` account may allow the hacker to take advantage of this authority.

![](https://accelerator-tasks-prod.s3.amazonaws.com/0ba47ddad6d14b37a1dab9268b739efa/diagrams/centralization-BOOFI_Distributor-_owner.svg)

In the contract `ERC20AndAvaxDistributorAdjustableBips` the role `_owner` has authority over the functions shown in the diagram below.

Any compromise to the `_owner` account may allow the hacker to take advantage of this authority.

![](https://accelerator-tasks-prod.s3.amazonaws.com/0ba47ddad6d14b37a1dab9268b739efa/diagrams/centralization-ERC20AndAvaxDistributorAdjustableBips-_owner.svg)

In the contract `ERC20DistributorAdjustableBips` the role `_owner` has authority over the functions shown in the diagram below.

Any compromise to the `_owner` account may allow the hacker to take advantage of this authority.

![](https://accelerator-tasks-prod.s3.amazonaws.com/0ba47ddad6d14b37a1dab9268b739efa/diagrams/centralization-ERC20DistributorAdjustableBips-_owner.svg)

In the contract `HauntedHouse` the role `_owner` has authority over the functions shown in the diagram below.

Any compromise to the `_owner` account may allow the hacker to take advantage of this authority.

![](https://accelerator-tasks-prod.s3.amazonaws.com/0ba47ddad6d14b37a1dab9268b739efa/diagrams/centralization-HauntedHouse-_owner.svg)

In the contract `HauntedHouse` the role `approvedContracts` has authority over the functions shown in the diagram below.

Any compromise to the `approvedContracts` account may allow the hacker to take advantage of this authority.

![](https://accelerator-tasks-prod.s3.amazonaws.com/0ba47ddad6d14b37a1dab9268b739efa/diagrams/centralization-HauntedHouse-approvedContracts.svg)

In the contract `HauntedHouse` the role `priceUpdater` has authority over the functions shown in the diagram below.

Any compromise to the `priceUpdater` account may allow the hacker to take advantage of this authority.

![](https://accelerator-tasks-prod.s3.amazonaws.com/0ba47ddad6d14b37a1dab9268b739efa/diagrams/centralization-HauntedHouse-priceUpdater.svg)

In the contract `HauntedHouse` the role `roles` has authority over the functions shown in the diagram below.

Any compromise to the `roles` account may allow the hacker to take advantage of this authority.

![](https://accelerator-tasks-prod.s3.amazonaws.com/0ba47ddad6d14b37a1dab9268b739efa/diagrams/centralization-HauntedHouse-roles.svg)

In the contract `Ownable` the role `_owner` has authority over the functions shown in the diagram below.

Any compromise to the `_owner` account may allow the hacker to take advantage of this authority.

![](https://accelerator-tasks-prod.s3.amazonaws.com/0ba47ddad6d14b37a1dab9268b739efa/diagrams/centralization-Ownable-_owner.svg)

In the contract `TWAP_Oracle` the role `_owner` has authority over the functions shown in the diagram below.

Any compromise to the `_owner` account may allow the hacker to take advantage of this authority.

![](https://accelerator-tasks-prod.s3.amazonaws.com/0ba47ddad6d14b37a1dab9268b739efa/diagrams/centralization-TWAP_Oracle-_owner.svg)

In the contract `Timelock` the role `admin` has authority over the functions shown in the diagram below.

Any compromise to the `admin` account may allow the hacker to take advantage of this authority.

![](https://accelerator-tasks-prod.s3.amazonaws.com/0ba47ddad6d14b37a1dab9268b739efa/diagrams/centralization-Timelock-admin.svg)

In the contract `Timelock` the role `pendingAdmin` has authority over the functions shown in the diagram below.

Any compromise to the `pendingAdmin` account may allow the hacker to take advantage of this authority.

![](https://accelerator-tasks-prod.s3.amazonaws.com/0ba47ddad6d14b37a1dab9268b739efa/diagrams/centralization-Timelock-pendingAdmin.svg)

In the contract `TopHarvestersDistributor` the role `_owner` has authority over the functions shown in the diagram below.

Any compromise to the `_owner` account may allow the hacker to take advantage of this authority.

![](https://accelerator-tasks-prod.s3.amazonaws.com/0ba47ddad6d14b37a1dab9268b739efa/diagrams/centralization-TopHarvestersDistributor-_owner.svg)

In the contract `ZombieBOOFI` the role `_owner` has authority over the functions shown in the diagram below.

Any compromise to the `_owner` account may allow the hacker to take advantage of this authority.

![](https://accelerator-tasks-prod.s3.amazonaws.com/0ba47ddad6d14b37a1dab9268b739efa/diagrams/centralization-ZombieBOOFI-_owner.svg)

In the contract `zBOOFI_Staking` the role `_owner` has authority over the functions shown in the diagram below.

Any compromise to the `_owner` account may allow the hacker to take advantage of this authority.

![](https://accelerator-tasks-prod.s3.amazonaws.com/0ba47ddad6d14b37a1dab9268b739efa/diagrams/centralization-zBOOFI_Staking-_owner.svg)

In the contract `zBOOFI_WithdrawalFeeCalculator` the role `_owner` has authority over the functions shown in the diagram below.

Any compromise to the `_owner` account may allow the hacker to take advantage of this authority.

![](https://accelerator-tasks-prod.s3.amazonaws.com/0ba47ddad6d14b37a1dab9268b739efa/diagrams/centralization-zBOOFI_WithdrawalFeeCalculator-_owner.svg)

In the contract `BoofiStrategyBase` the role `_owner` has authority over the functions shown in the diagram below.

Any compromise to the `_owner` account may allow the hacker to take advantage of this authority.

![](https://accelerator-tasks-prod.s3.amazonaws.com/0ba47ddad6d14b37a1dab9268b739efa/diagrams/centralization-BoofiStrategyBase-_owner.svg)

In the contract `BoofiStrategyForCTokenStaking` the role `_owner` has authority over the functions shown in the diagram below.

Any compromise to the `_owner` account may allow the hacker to take advantage of this authority.

![](https://accelerator-tasks-prod.s3.amazonaws.com/0ba47ddad6d14b37a1dab9268b739efa/diagrams/centralization-BoofiStrategyForCTokenStaking-_owner.svg)

In the contract `BoofiStrategyForDexStaking` the role `_owner` has authority over the functions shown in the diagram below.

Any compromise to the `_owner` account may allow the hacker to take advantage of this authority.

![](https://accelerator-tasks-prod.s3.amazonaws.com/0ba47ddad6d14b37a1dab9268b739efa/diagrams/centralization-BoofiStrategyForDexStaking-_owner.svg)

In the contract `BoofiStrategyForDexStakingMultiRewards` the role `_owner` has authority over the functions shown in the diagram below.

Any compromise to the `_owner` account may allow the hacker to take advantage of this authority.

![](https://accelerator-tasks-prod.s3.amazonaws.com/0ba47ddad6d14b37a1dab9268b739efa/diagrams/centralization-BoofiStrategyForDexStakingMultiRewards-_owner.svg)

In the contract `BoofiStrategyForJoeLending` the role `_owner` has authority over the functions shown in the diagram below.

Any compromise to the `_owner` account may allow the hacker to take advantage of this authority.

![](https://accelerator-tasks-prod.s3.amazonaws.com/0ba47ddad6d14b37a1dab9268b739efa/diagrams/centralization-BoofiStrategyForJoeLending-_owner.svg)

In the contract `BoofiStrategyForQiStaking` the role `_owner` has authority over the functions shown in the diagram below.

Any compromise to the `_owner` account may allow the hacker to take advantage of this authority.

![](https://accelerator-tasks-prod.s3.amazonaws.com/0ba47ddad6d14b37a1dab9268b739efa/diagrams/centralization-BoofiStrategyForQiStaking-_owner.svg)

In the contract `BoofiStrategyForQiStaking_WAVAX` the role `_owner` has authority over the functions shown in the diagram below.

Any compromise to the `_owner` account may allow the hacker to take advantage of this authority.

![](https://accelerator-tasks-prod.s3.amazonaws.com/0ba47ddad6d14b37a1dab9268b739efa/diagrams/centralization-BoofiStrategyForQiStaking_WAVAX-_owner.svg)

In the contract `CauldronPriceUpdater` the role `_owner` has authority over the functions shown in the diagram below.

Any compromise to the `_owner` account may allow the hacker to take advantage of this authority.

![](https://accelerator-tasks-prod.s3.amazonaws.com/0ba47ddad6d14b37a1dab9268b739efa/diagrams/centralization-CauldronPriceUpdater-_owner.svg)

In the contract `CauldronPriceUpdater` the role `whitelist` has authority over the functions shown in the diagram below.

Any compromise to the `whitelist` account may allow the hacker to take advantage of this authority.

![](https://accelerator-tasks-prod.s3.amazonaws.com/0ba47ddad6d14b37a1dab9268b739efa/diagrams/centralization-CauldronPriceUpdater-whitelist.svg)

Centralization Risks

The `strategy` contracts are serving as the underlying entity to interact with third parties. These contracts use tokens pledged by users to `HauntedHouse` to invest. The user's tokens are pledged to third-party contracts to receive rewards. And the rewards will be swapped to the `Boofi` tokens by the third-party contracts. The scope of the audit treats 3rd party contracts as black boxes and assumes their functional correctness. 

The `HauntedHouse` contract is serving as the underlying entity to interact with the third-party contract `Rewarder` to call the function `onZBoofiReward()`.

However, in the real world, 3rd parties can be compromised and this may lead to lost or stolen assets. In addition, upgrades of 3rd parties can possibly create severe impacts, such as increasing fees of 3rd parties, migrating to new LP pools, etc.

Third Party Dependencies

The strategy contracts give some third-party contracts the unlimited allowance. This will cause the transaction function to skip the allowance checksum. This could potentially cause the transaction to be insecure.

Potentially Dangerous Allowance

The function `deposit()` adds a new staking before claiming the reward. This may cause the newly added staking token to receive an additional reward.

Staking Before Claiming Rewards

In the contract `CauldronPriceUpdater.sol`, the role `owner` has the power to set the address of `oracle`.

Any compromise on the `owner` account could allow a hacker to use this power and change the address of `oracle` to manipulate prices.

Centralization Related Risks

The fallback function can only rely on 2300 gas being available (for example when sending or transfer is used), the calling of the `defaultSplit()` function in the fallback function will cost more than 2300 gas and more extra gas is required. Is that designed as expected? (https://docs.soliditylang.org/en/v0.5.8/contracts.html#fallback-function)

Potential Out-of-Gas Exception

In contracts `HauntedHouse`, `HauntedHouseAvaxDepositHelper` and `BoofiStrategyForCTokenStaking`, we understand modifier `onlyApprovedContractOrEOA` is necessary to avoid flash loan attacks. Please keep in mind that the line of code `msg.sender == tx.origin` would be potentially deprecated if EIP-3074 passed.

Currently, EIP-3074 is still in review status and there are no clear signals of passing or not. Strongly recommend monitoring the status of EIP-3074, and upgrading the contract before the Ethereum update, if it passes.

Refer to the Ethereum improvement proposals page `https://eips.ethereum.org/EIPS/eip-3074`.

Warning on EIP-3074

The variable `globalCumulativeAverage` has been updated, but never accessed

Redundant Statements

The lower limit of delay time may be too short.

Delay Time Too Short

BooFinance

BOOFI_Distributor.sol

BoofiStrategyBase.sol

BoofiStrategyForDexStaking.sol

staking

zBOOFI_WithdrawalFeeCalculator.sol

TWAP_Oracle.sol

ERC20WithVoting.sol

TopHarvestersDistributor.sol

BOOFI.sol

HauntedHouseAvaxDepositHelper.sol

ERC20WithVotingAndPermit.sol

CauldronPriceUpdater.sol

distributors

BoofiStrategyForJoeLending.sol

BoofiStrategyForPangolinMiniChefStaking.sol

strategies

BoofiStrategyForCTokenStaking.sol

tokens

ERC20AndAvaxDistributorAdjustableBips.sol

BoofiStrategyForJoeV2Staking.sol

zBOOFI_Staking.sol

BoofiStrategyForLydiaStaking.sol

BoofiStrategyForQiStaking_WAVAX.sol

TokenOrAvaxTransfer.sol

BoofiStrategyForPangolinStaking.sol

ERC20AndAvaxDistributor.sol

HauntedHouse.sol

BoofiStrategyForJoeV3Staking.sol

ZombieBOOFI.sol

zBOOFI_Staking_Helper.sol

Timelock.sol

BoofiStrategyForDexStakingMultiRewards.sol

BoofiStrategyForQiStaking.sol

ERC20DistributorAdjustableBips.sol

ERC20Distributor.sol

BooFinance 

From DeFi to scam awareness, this site arms beginners with the tools they need to thrive in crypto - Cointelegraph

DeFi auditor nets $40,000 for identifying Uniswap vulnerability

DeFi Analyst Predicts $2.00 Per Token For Both Uniglo.io And Ripple In 2023 | NewsBTC

DeFi Exchange Mango's $114M Exploit Was 'Market Manipulation,' Not a Hack, Ex-FBI Special Agent Says

Disney hiring transaction lawyer for ‘aggressive’ NFT and DeFi plans

Gibraltar Will Focus on Stablecoins and DeFi Lending After Market Turmoil

Brett Harrison raises $5 million for DeFi platform aimed at institutions: Bloomberg

Hacker Exploits BNB Chain-Based DeFi Protocol Ankr

Next Level DeFi Concepts From Uniglo.io (GLO) Works In Tandem With Uniswap (UNI) And Bored Ape Yacht Club (BAYC)

A16z Doesn’t Support Plan to Break Up DeFi Giant MakerDAO

DeFi-Focused Startup Blue Comes Out of Stealth With $3.2M Raise

Presales Like Uniglo.io (GLO) Are Generating Demand As Ethereum (ETH) Merge Looks To Benefit DeFi And UniSwap (UNI) | NewsBTC

From neglecting security to bad tokenomics, DeFi has played a hand in its own decline

2023 Investment Guide: DeFi Giants Celsius Network (CEL) and Aave (AAVE) | Bitcoinist.com

Nasdaq's Crypto Move, $160M DeFi Hack, Hong Kong CBDC + More News

Coinbase CEO: Regulate centralized actors but leave DeFi alone

Comparing Axie Infinity and Cardano to Big Eyes Coin Next-Gen DeFi Services

DeFi user loses $3.4 million of GMX tokens in phishing attack

Circle, Uniswap Research Says DeFi Can Solve $2 Trillion FX Risk Problem

Aptos DeFi project under fire, asks community for confidence vote

Confused by an avalanche of Medicare ads? Deceptive marketing has some experts calling for action.

BooFinance  Token

BooFinance

Highlights & Alerts

This is just a placeholder

highlight placeholder lorem Ipsum...

highlight lorem

This is a alert demo

Alert demo

Code Audit History

10

0

8

2

0