Read the findings of the 2022 Web3 Security Report

In the contract `VeniStaker.sol`, the comment in line 486 reads "Special case, use the locked balances and supply for stakingReward rewards". So that, the source of user rewards is the fine withdrawn in advance. At the same time is there a situation where the penalty amount is less than the bonus amount? If the stake deposit is misappropriated to issue rewards at this time, is there a risk of insufficient staked assets? How does the team plan to deal with this risk?

Financial Models

The linked variables do not conform to the standard naming convention of Solidity whereby functions and variable names utilize the format unless variables are declared as constant in which case they utilize the format.

Variable Naming Convention

The comment in line L71, mentioned // XXX DO NOT add the same LP token more than once. Rewards will be messed up if you do.

The total amount of reward in function `updatePool()` will be incorrectly calculated if the same LP token is added into the pool more than once in function `add()`.

However, the code is not reflected in the comment behaviors as there isn’t any valid restriction on preventing this issue.

The current implementation is relying on the trust of the owner to avoid repeatedly adding the same LP token to the pool, as the function will only be called by the owner.

add() Function Not Restricted

There's no sanity check to validate if a pool is existing.

Recommended Explicit Pool Validity Checks

In the contract, `MasterChef`, the role, `_owner`, has the authority over the functions shown in the diagram below.

Any compromise to the privileged account which has access to `_owner` may allow the hacker to take advantage of this.

![](https://accelerator-tasks-prod.s3.amazonaws.com/62b23d6baae04984aa42e158f550630b/MasterChef-_owner.svg)

Centralization Risk in MasterChef.sol

In the current version `0.6.12`, the result of the calculation `0 - 1`, will get the max value. But if the version is higher than `0.8.0`, there will throw an exception.

The problem of calculation

There should always be events emitted in the sensitive functions that are controlled by centralization roles.

Missing emit events

The contract has unlocked compiler version. An unlocked compiler version in the source code of the contract permits the user to compile it at or above a particular version. This, in turn, leads to differences in the generated bytecode between compilations due to different compiler versions. This can lead to an ambiguity when debugging as compiler specific bugs may occur in the codebase that would be hard to identify over a span of multiple compiler versions rather than a specific one.

Unlocked compiler version

The **require** can be used to check for conditions and throw an exception if the condition is not met. It is better to provide a string message containing details about the error that will be passed back to the caller.

Missing error messages

The order of external `call/transfer` and storage manipulation must follow the `check-effect-interaction` pattern.

Check Effect Interaction Pattern Violated

In the contract, `VeniceFactory`, the role, `feeToSetter`, has the authority over the functions shown in the diagram below.

Any compromise to the privileged account which has access to `feeToSetter` may allow the hacker to take advantage of this.

![](https://accelerator-tasks-prod.s3.amazonaws.com/62b23d6baae04984aa42e158f550630b/VeniceFactory-feeToSetter.svg)

Centralization Related Risks in VeniceFactory.sol

The liquidity calculation is `1/6th` in the comment, but not in the code. The liquidity value should be included in the white paper and users should know this info.

Comment is inconsistent with code

The variable `amountInput` is a local variable and never initialized before use.

Variable never initialized

In the contract, `VeniStaker`, the role, `_owner`, has the authority over the functions shown in the diagram below.

Any compromise to the privileged account which has access to `_owner` may allow the hacker to take advantage of this.

![](https://accelerator-tasks-prod.s3.amazonaws.com/62b23d6baae04984aa42e158f550630b/VeniStaker-_owner.svg)

In the contract, `VeniStaker`, the role, `minters`, has the authority over the functions shown in the diagram below.

Any compromise to the privileged account which has access to `minters` may allow the hacker to take advantage of this.

![](https://accelerator-tasks-prod.s3.amazonaws.com/62b23d6baae04984aa42e158f550630b/VeniStaker-minters.svg)

In the contract, `VeniStaker`, the role, `rewardDistributors`, has the authority over the functions shown in the diagram below.

Any compromise to the privileged account which has access to `rewardDistributors` may allow the hacker to take advantage of this.

![](https://accelerator-tasks-prod.s3.amazonaws.com/62b23d6baae04984aa42e158f550630b/VeniStaker-rewardDistributors.svg)

Centralization Risk in VeniStaker.sol

The `stakingToken` address will be initialized by parameters. It is uncertain about the real value. The success of the call to `mint` is not guaranteed.

The scope of this audit would treat the external dependency entity as black boxes and assume functional correctness. 

External dependency

Venice Finance

VeniceRouter.sol

MasterChef.sol

VeniStaker.sol

VeniceERC20.sol

VenicePair.sol

VeniceFactory.sol

In the contract, `Venice`, the role, `_owner`, has the authority over the functions shown in the diagram below.

Any compromise to the privileged account which has access to `_owner` may allow the hacker to take advantage of this.

![](https://accelerator-tasks-prod.s3.amazonaws.com/8c8f3a449ec64dfca91fb08defc777cf/Venice-_owner.svg)

In the contract, `Venice`, the role, `_minters`, has the authority to call function `mint()`, which is used to mint `VENI` token to any specified address.

Any compromise to the privileged account which has access to `_minters` may allow the hacker to take advantage of this.

Venice Finance

Highlights & Alerts

This is just a placeholder

highlight placeholder lorem Ipsum...

highlight lorem

This is a alert demo

Alert demo

Code Audit History

15

0

9

0

6