Read the findings of the 2022 Web3 Security Report

The function `totalSupplyAt()` returns the total supply at a certain block number, however, it actually returns the total supply. 

Discussion about Function `totalSupplyAt()`

The `EMISSION_MANAGER` of the contract `StakedTokenIncentivesController` has the responsibility to notify users about the following capabilities:
- set `_distributionEnd` through `setDistributionEnd()`
- set claimer through `setClaimer()`
- configures the distribution of rewards for a list of assets through `configureAssets()`

The `EMISSION_MANAGER` of the contract `PullRewardsIncentivesController` has the responsibility to notify users about the following capabilities:
- set `_distributionEnd` through `setDistributionEnd()`
- set claimer through `setClaimer()`
- configures the distribution of rewards for a list of assets through `configureAssets()`
- set `_rewardsVault` through `setRewardsVault()`

The `_authorizedClaimers` of the contract `StakedTokenIncentivesController`/`PullRewardsIncentivesController` has the responsibility to notify users about the following capabilities:
- claim rewards on behalf through `claimRewardsOnBehalf()`

Any compromise to the `EMISSION_MANAGER`/`_authorizedClaimers` account may allow a hacker to take advantage of this authority.


Centralization Related Risks

The function can be affected by a flashloan attack such that the new stable borrow rate becomes the lowest possible.
A malicious actor can first request a flashloan to deposit into the reserve pool so that the reserve’s utilization rate is close to 0, then invoke `swapBorrowRateMode()` to perform the variable-to-borrow rate switch and enjoy the lowest `currentStableBorrowRate`, and finally withdraw to return the flashloan. A similar approach can also be applied to bypass `maxStableLoanPercent` enforcement in `validateBorrow()`.

Potential Flashloan Attack

When transferring standard ERC20 deflationary tokens, the input amount may not be equal to the received amount due to the charged transaction fee. As a result, an inconsistency in the amount will occur and the transaction may fail due to the validation checks.

Incompatibility With Deflationary Tokens

The parameter `deadline`, `v`,`r` and `s` are not used in the function.

Unused Parameter

The contract is serving as the underlying entity to interact with third-party protocols such as Price Oracle, including:
- `IChainlinkAggregator.latestAnswer()`

Third Party Dependencies

The `owner` of the contract `TokenVesting` has the responsibility to notify users about the following capabilities:
- creates a new vesting schedule for a beneficiary through `createVestingSchedule()`
- revokes the vesting schedule for the given identifier through `revoke()`
- withdraw the specified amount to himself/herself through `withdraw()`

The `owner` of the contract `StarlayRewardsVault` has the responsibility to notify users about the following capabilities:
- set `incentiveController` through `setIncentiveController()`
- transfer uncapped tokens to `incentiveController` through `transfer()`

Any compromise to the `owner` account may allow a hacker to take advantage of this authority.

The `EMISSION_MANAGER` of the contract `DistributionManager` has the responsibility to notify users about the following capabilities:
- configures the distribution of rewards for a list of assets through `configureAssets()`
  
Any compromise to the `EMISSION_MANAGER` account may allow a hacker to take advantage of this authority.


The `owner` of the contract `LendingPoolAddressesProviderRegistry` has the responsibility to notify users about the following capabilities:
- registers an addresses provider through `registerAddressesProvider()`
- removes a LendingPoolAddressesProvider from the list of registered addresses provider through `unregisterAddressesProvider()`

The `owner` of the contract `LendingPoolAddressesProvider` has the responsibility to notify users about the following capabilities:
- allows to set the market which this LendingPoolAddressesProvider represents through `setMarketId()`
- updates the implementation of a proxy registered with certain `id` through `setAddressAsProxy()`
- sets an address for an id replacing the address saved in the addresses map through `setAddress()`
- updates the implementation of the LendingPool, or creates the proxy through `setLendingPoolImpl()`
- updates the implementation of the LendingPoolConfigurator, or creates the proxy through `setLendingPoolConfiguratorImpl()`
- updates the address of the LendingPoolCollateralManager through `setLendingPoolCollateralManager()`
- sets pool admin through `setPoolAdmin()`
- sets emergency admin through `setEmergencyAdmin()`
- sets price oracle through `setPriceOracle()`
- sets lending rate oracle through `setLendingRateOracle()`

The `owner` of the contract `WETHGateway` has the responsibility to notify users about the following capabilities:
- authorize lending pool through `authorizeLendingPool()`
- transfer ERC20 from the utility contract through `emergencyTokenTransfer()`
- transfer native Ether from the utility contract through `emergencyEtherTransfer()`

The `owner` of the contract `StarlayOracle` has the responsibility to notify users about the following capabilities:
- sets `_adapter` through `setPriceAggregator()`
- sets `_fallbackOracle` through `setFallbackOracle()`

The `owner` of the contract `StarlayFallbackOracle` has the responsibility to notify users about the following capabilities:
- authorizes `Sybil` through `authorizeSybil()`
- unauthorizes `Sybil` through `unauthorizeSybil()`

The `owner` of the contract `StableAndVariableTokensHelper` has the responsibility to notify users about the following capabilities:
- inits deployment through `initDeployment()`
- sets oracle borrow rates through `setOracleBorrowRates()`
- sets oracle ownership through `setOracleOwnership()`

The `owner` of the contract `PriceAggregatorAdapterDiaImpl` has the responsibility to notify users about the following capabilities:
- sets `_aggregator` through `setAggregator()`
- sets or replaces sources of assets through `setAssetSources()`

The `owner` of the contract `PriceAggregatorAdapterChainlinkImpl` has the responsibility to notify users about the following capabilities:
- sets or replaces sources of assets through `setAssetSources()`

The `owner` of the contract `LTokensAndRatesHelper` has the responsibility to notify users about the following capabilities:
- inits deployment through `initDeployment()`
- configures reserves through `configureReserves()`

Any compromise to the `owner` account may allow a hacker to take advantage of this authority.

The `lendingPool` of the contract `LToken`/`DelegationAwareLToken` has the responsibility to notify users about the following capabilities:
- burns `lTokens` from `user` and sends the equivalent amount of underlying to `receiverOfUnderlying` through `burn()`
- mints `amount` `lTokens` to `user` through `mint()`
- mints `lTokens` to the reserve treasury through `mintToTreasury()`
- transfers `lTokens` in the event of a borrow being liquidated, in case the liquidators reclaims the `lToken` through `transferOnLiquidation()`
- transfers the underlying asset to `target` through `transferUnderlyingTo()`
- invoked to execute actions on the `lToken` side after a repayment through `handleRepayment()`

The `lendingPool` of the contract `VariableDebtToken`/`StableDebtToken` has the responsibility to notify users about the following capabilities:
- mints debt token to the `onBehalfOf` address through `mint()`
- burns user variable debt through `burn()`

Any compromise to the `lendingPool` account may allow a hacker to take advantage of this authority.

The `poolAdmin` of the contract `DelegationAwareLToken` has the responsibility to notify users about the following capabilities:
- delegates voting power of the underlying asset to a `delegatee` address through `delegateUnderlyingTo()`

The `poolAdmin` of the contract `LendingPoolConfigurator` has the responsibility to notify users about the following capabilities:
- initializes reserves in batch through `batchInitReserve()`
- updates the `lToken` implementation for the reserve through `updateLToken()`
- updates the stable debt token implementation for the reserve through `updateStableDebtToken()`
- updates the variable debt token implementation for the asset through `updateVariableDebtToken()`
- enables borrowing on a reserve through `enableBorrowingOnReserve()`
- disables borrowing on a reserve through `disableBorrowingOnReserve()`
- configures the reserve collateralization parameters through `configureReserveAsCollateral()`
- enable stable rate borrowing on a reserve through `enableReserveStableRate()`
- disable stable rate borrowing on a reserve through `disableReserveStableRate()`
- activates a reserve  through `activateReserve()`
- deactivates a reserve through `deactivateReserve()`
- freezes a reserve through `freezeReserve()`
- unfreezes a reserve through `unfreezeReserve()`
- updates the reserve factor of a reserve through `setReserveFactor()`
- sets the interest rate strategy of a reserve through `setReserveInterestRateStrategyAddress()`

Any compromise to the `poolAdmin` account may allow a hacker to take advantage of this authority.

The `emergencyAdmin` of the contract `LendingPoolConfigurator` has the responsibility to notify users about the following capabilities:
- pauses or unpauses all the actions of the protocol, including `lToken` transfers through `setPoolPause()`

Any compromise to the `emergencyAdmin` account may allow a hacker to take advantage of this authority.


The `lendingPoolConfigurator` of the contract `LendingPool` has the responsibility to notify users about the following capabilities:
- initializes a reserve, activating it, assigning a `lToken` and debt tokens and an interest rate strategy through `initReserve()`
- updates the address of the interest rate strategy contract through `setReserveInterestRateStrategyAddress()`
- sets the configuration bitmap of the reserve as a whole through `setConfiguration()`
- sets the _pause state of a reserve through `setPause()`

Any compromise to the `lendingPoolConfigurator` account may allow a hacker to take advantage of this authority.

The `Admin` of the contract `BaseImmutableAdminUpgradeabilityProxy` has the responsibility to notify users about the following capabilities:
- views the address of the proxy admin through `admin()`
- views the address of the implementation through `implementation()`
- upgrades the backing implementation of the proxy through `upgradeTo()`
- upgrades the backing implementation of the proxy and calls a function on the new implementation through `upgradeToAndCall()`

Any compromise to the `Admin` account may allow a hacker to take advantage of this authority.

The `Sybil` of the contract `StarlayFallbackOracle` has the responsibility to notify users about the following capabilities:
- submits prices through `submitPrices()`

Any compromise to the `Sybil` account may allow a hacker to take advantage of this authority.


Addresses should be checked before assigning to make sure they are not zero addresses.

Lack of Zero Address Validation

Malicious hackers may observe the pending transaction which will execute the `initialize` function and launch a similar transaction with the hacker's address, set variables of the contract.

Potential Front-Running Risk

The `permit` function performs the operation of deriving signer address from the signature values of `v`, `r` and `s`. The state variable `DOMAIN_SEPARATOR` that is used to calculate hash has a value of `chainid` that is derived only once in the constructor, which does not change after contract deployment. The issue arises in the event of fork when the cross-chain replay attacks can be executed.
The attack scenario can be thought of as if a fork of Ethereum happens and two different networks have id of for example `1` and `9`. The `chainid` coded in `DOMAIN_SEPARATOR` will be the same on contracts residing in both of the forks. If the chainid `1` is stored in the contract then the `permit` transaction signed for chainid `1` will be executable on both of the forks.

Possibility of Replay Attack in `Permit`

The signature malleability is possible within the Elliptic Curve cryptographic system. An Elliptic Curve is symmetric on the X-axis, meaning two points can exist with the same `X` value. In the `r`, `s` and `v` representation this permits us to carefully adjust `s` to produce a second valid signature for the same `r`, thus breaking the assumption that a signature cannot be replayed in what is known as a replay-attack.

Susceptible to Signature Malleability

Functions that affect the status of sensitive variables should be able to emit events as notifications to customers.

Missing Emit Events

1. The function `mint()` can be called by anyone to mint tokens for themselves.
2. The function `doubleSend()` can be called by anyone to transfer the contract's tokens to anyone.

Lack of Access Control

`initialSupply` tokens were sent to the `msg.sender` when deploying the contract. 
This could be a centralization risk as the deployer can distribute tokens without obtaining the consensus of the community.

Initial Token Distribution

`require` can be used to check for conditions and throw an exception if the condition is not met, in which case the descriptive error message provided by the developer will appear and help to track error and debugging.

Lack of Error Message

Comparison to A Boolean Constant

Starlay

ERC20.sol

WalletBalanceProvider.sol

IStakedLay.sol

ILendingPoolConfigurator.sol

IUiPoolDataProviderV2.sol

IDelegationToken.sol

IDiaAggregator.sol

StarlayFallbackOracle.sol

GovernancePowerDelegationERC20.sol

LendingPoolAddressesProviderRegistry.sol

DelegationAwareLToken.sol

upgradeability

IERC20WithPermit.sol

StarlayProtocolDataProvider.sol

interfaces

ILendingPoolAddressesProvider.sol

IWETHGateway.sol

IConfigurableRightsPool.sol

IERC20WithNonce.sol

IIncentivesController.sol

stake-v1

IScaledBalanceToken.sol

IBPool.sol

DefaultReserveInterestRateStrategy.sol

PriceAggregatorAdapterDiaImpl.sol

IncentivizedERC20.sol

Initializable.sol

configuration

IStarlayOracle.sol

StakedLay.sol

IDistributionManager.sol

StableDebtToken.sol

IERC20.sol

ILendingRateOracle.sol

PercentageMath.sol

IIncentivesExecutor.sol

IStarlayRewardsVault.sol

IDelegationAwareToken.sol

IInitializableDebtToken.sol

IPriceAggregatorAdapter.sol

vault

PullRewardsIncentivesController.sol

LendingPoolConfigurator.sol

utils

IWETH.sol

IReserveInterestRateStrategy.sol

IStakedToken.sol

flashloan

base

IProposalIncentivesExecutor.sol

MintableErc20.sol

incentives

deployments

TokenVesting.sol

ILendingPoolData.sol

WadRayMath.sol

math

IChainlinkAggregator.sol

IAToken.sol

StarlayRewardsVault.sol

InitializableAdminUpgradeabilityProxy.sol

VersionedInitializable.sol

UiIncentiveDataProviderV2.sol

LendingPoolStorage.sol

LToken.sol

helpers

open-zeppelin

ILendingPoolAddressesProviderRegistry.sol

IStakedTokenWithConfig.sol

contracts

AdminUpgradeabilityProxy.sol

IGovernancePowerDelegationToken.sol

DataTypes.sol

BaseAdminUpgradeabilityProxy.sol

ReentrancyGuard.sol

StakedTokenIncentivesController.sol

StableAndVariableTokensHelper.sol

SelfdestructTransfer.sol

IERC20Detailed.sol

InitializableImmutableAdminUpgradeabilityProxy.sol

SafeMath.sol

StakedLayV2.sol

Errors.sol

Proxy.sol

BaseIncentivesController.sol

ReserveLogic.sol

FlashLoanReceiverBase.sol

Starlay 

Bear Market 2022 — Two Top Crypto Tokens to Invest in: Polkadot and Big Eyes Coin

Insane Gains On The Cards For Uniglo.io According To Bitcoin And Polkadot Whales | NewsBTC

Ether, Polkadot slide with equities as Silvergate surrenders Monday’s gains

Polkadot Co-Founder Gavin Wood Steps Down From CEO Role at Blockchain's Builder: Report

The Web3 Foundation taps edX for free courses on blockchain and Polkadot

Polkadot: How parachains are changing a blockchain-centric ecosystem

Shiba Inu (SHIB) Flips Polkadot (DOT) as SHIB Burn Rate Sparks Up 6,016%

Polkadot (DOT) Price Analysis for October 22

Dogecoin Surpasses Polkadot - Can DOGE Maintain Its Aggressiveness?

Polkadot (DOT) And Moonbeam (GLMR) Price Declines As The Hideaways (HDWY) Gains Traction | NewsBTC

Three Crypto Platforms You Must Invest In Before 2023, With Big Eyes Coin, Solana And Polkadot | NewsBTC

Immunefi researcher saves $200 million from potential theft on three Polkadot parachains

Polkadot Co-Founder Gavin Wood Steps Down From CEO Role at Blockchain's Builder

Polkadot (DOT), Ethereum (ETH), and The Hideaways (HDWY) Value Will Rise | Bitcoinist.com - Bitcoinist

Price Forecast: Buy Or Sell Polkadot (DOT) And Ethereum Classic (ETC)

Polkadot (DOT) Dethrones Dogecoin To Join Crypto Top 10

Polkadot (DOT) Community Believes Coin Will End 2022 with 41% Upside

Polkadot-based protocol t3rn raises $6.5 million: Exclusive

Big Eyes Coin Raised $1 Million In the First Week Of Its Presale, Posing A Threat To Tamadoge And Polkadot | NewsBTC

Polkadot (DOT) in Correction Zone After Pumping on “Not a Security” Comments

FTX Bear Market Sees Investors Flock To The Hideaways (HDWY), Selling Polkadot (DOT) and Tron (TRX) | NewsBTC

Starlay  Token

Starlay

Highlights & Alerts

This is just a placeholder

highlight placeholder lorem Ipsum...

highlight lorem

This is a alert demo

Alert demo

Code Audit History

18

0

9

0

9