Read the findings of the 2022 Web3 Security Report

The linked statements do not affect the functionality of the codebase and appear to be either leftovers from test code or older functionality.

Redundant Code Components

The linked variables could be declared as `constant` since these state variables are never modified.

Variables That Could Be Declared as `constant`

`public` functions that are never called by the contract could be declared as `external`.

Improper Usage of `public` and `external` Type

Multiple Solidity versions are used in the codebase.

Versions used: `^0.5.16`, `^0.5.0`.

Different Solidity Versions

Although the `Pool` contract has inherited the contract `Owned`, the features of `Owned` are not used in the contract.

The `Turbo` contract redundantly extends the `Owned` one, as its functionality is already available through `Proxyable`.

Redundant Inheritance

In the contract `ExchangeRates` the role `_owner` has authority over the functions shown in the diagram below.

- `setOracle()`, to set the oracle contract address.
- `setRateStalePeriod()`, to set the stale period of rate.
- `setAggregatorWarningFlags()`.
- `addAggregator()`, to add a new Chainlink aggregator.
- `removeAggregator()`.

Any compromise to the `_owner` account may allow the hacker to take advantage of this authority.

![](https://accelerator-tasks-prod.s3.amazonaws.com/79c958c03a134521978202208b9f9f36/diagrams/centralization-ExchangeRates-_owner.svg)

In the contract `ExchangeRates` the role `oracle` has authority over the following functions.

- `updateRates()`, to update the exchange rate.
- `deleteRate()`.

Any compromise to the `oracle` account may allow the hacker to take advantage of this authority.


Centralization Risk in ExchangeRates.sol

The contract is serving as the underlying entity to interact with third party Chainlink protocol. The scope of the audit treats 3rd party entities as black boxes and assume their functional correctness. However, in the real world, 3rd parties can be compromised and this may lead to lost or stolen assets. In addition, upgrades of 3rd parties can possibly create severe impacts.

Third Party Dependencies

In the contract `Owned` the role `owner` has authority over the following function.

- `nominateNewOwner()`, to begin transfer of admin role. The `nominatedOwner` must call `acceptOwnership()` to finalize the transfer.

Any compromise to the `owner` account may allow the hacker to take advantage of this authority.

In the contract `Owned` the role `nominatedOwner` has authority over the function shown in the diagram below.

- `acceptOwnership()`, to finish transferring ownership to the `nominatedOwner` account address.

Any compromise to the `nominatedOwner` account may allow the hacker to take advantage of this authority.

![](https://accelerator-tasks-prod.s3.amazonaws.com/79c958c03a134521978202208b9f9f36/diagrams/centralization-Owned-nominatedOwner.svg)

Centralization Risk in Owned.sol

The return value of the `transfer()/transferFrom()` call is not checked.

```solidity=71
  token.transferFrom(msg.sender, address(this), _amount);
```

```solidity=122
  token.transfer(msg.sender, _amount);
```

Unchecked ERC-20 `transfer()`/`transferFrom()` Call

A reentrancy attack can occur when the contract creates a function that makes an external call to another untrusted contract before resolving any effects. 
If the attacker can control the untrusted contract, they can make a recursive call back to the original function, repeating interactions that would have otherwise not run after the external call resolved the effects. 

The function `unStake()` has external call before emit event, it is vulnerable to reentrancy attack.

```solidity=121
	if (symbol != GasToken) {
		token.transfer(msg.sender, _amount);
	} else {
		msg.sender.transfer(_amount);
	}

	emit UnStake(msg.sender, _amount);	
```

Potential Reentrancy Attack

The users who deposit tokens into the pool will be added to the array `stakedAddresses`. However, the function `unStake()` does not remove the user from this array when the user unstakes all their tokens.

```solidity=117
	if (_stakeData.amount == 0) {
		userAmount = userAmount.sub(1);
	}
```


Unstake Not Remove Address from `stakedAddresses`

In the contract `Proxy` the role `_owner` has authority over the functions shown in the diagram below.

- `setTarget()`, to upgrade the target contract of the proxy.

Any compromise to the `_owner` account may allow the hacker to take advantage of this authority.

![](https://accelerator-tasks-prod.s3.amazonaws.com/79c958c03a134521978202208b9f9f36/diagrams/centralization-Proxy-_owner.svg)

Centralization Risk in Proxy.sol

In the contract `Proxyable` the role `_owner` has authority over the functions shown in the diagram below.

- `setProxy()`, to set the `proxy` contract address.
- `setIntegrationProxy()`, to set the `integrationProxy` contract address.

Any compromise to the `_owner` account may allow the hacker to take advantage of this authority.

![](https://accelerator-tasks-prod.s3.amazonaws.com/79c958c03a134521978202208b9f9f36/diagrams/centralization-Proxyable-_owner.svg)

Centralization Risk in Proxyable.sol

There should always be events emitted in the sensitive functions that are controlled by centralization roles.

Missing Emit Events

TurboStarter

IERC20.sol

Turbo.sol

TurboStarter

Highlights & Alerts

This is just a placeholder

highlight placeholder lorem Ipsum...

highlight lorem

This is a alert demo

Alert demo

Code Audit History

14

0

13

0

1