Skip to content

report.md

Latest commit

 

History

History
259 lines (156 loc) · 6.94 KB

report.md

File metadata and controls

259 lines (156 loc) · 6.94 KB
Raw

Aderyn Analysis Report

This report was generated by Aderyn, a static analysis tool built by Cyfrin, a blockchain security company. This report is not a substitute for manual audit or security review. It should not be relied upon for any purpose other than to assist in the identification of potential security vulnerabilities.

Table of Contents

Summary

Files Summary

Key Value
.sol Files 10
Total nSLOC 719

Files Details

Filepath nSLOC
src/adapter/PriceLoomAdapterFactory.sol 30
src/adapter/PriceLoomAggregatorV3Adapter.sol 51
src/examples/TestPriceConsumer.sol 12
src/interfaces/AggregatorV3Interface.sol 14
src/interfaces/IOracleAdmin.sol 10
src/interfaces/IOracleReader.sol 20
src/libraries/PriceLoomMath.sol 35
src/libraries/Sort.sol 7
src/oracle/PriceLoomOracle.sol 516
src/oracle/PriceLoomTypes.sol 24
Total 719

Issue Summary

Category No. of Issues
High 0
Low 6

Low Issues

L-1: Centralization Risk

Contracts have owners with privileged rights to perform admin tasks and need to be trusted to not perform malicious updates or drain funds.

7 Found Instances

  • Found in src/oracle/PriceLoomOracle.sol Line: 63

     contract PriceLoomOracle is AccessControl, Pausable, ReentrancyGuard, EIP712, IOracleAdmin, IOracleReader {

  • Found in src/oracle/PriceLoomOracle.sol Line: 120

             onlyRole(FEED_ADMIN_ROLE)

  • Found in src/oracle/PriceLoomOracle.sol Line: 155

         function setFeedConfig(bytes32 feedId, OracleTypes.FeedConfig calldata cfg) external onlyRole(FEED_ADMIN_ROLE) {

  • Found in src/oracle/PriceLoomOracle.sol Line: 166

         function addOperator(bytes32 feedId, address op) external onlyRole(FEED_ADMIN_ROLE) {

  • Found in src/oracle/PriceLoomOracle.sol Line: 177

         function removeOperator(bytes32 feedId, address op) external onlyRole(FEED_ADMIN_ROLE) {

  • Found in src/oracle/PriceLoomOracle.sol Line: 199

         function pause() external onlyRole(PAUSER_ROLE) {

  • Found in src/oracle/PriceLoomOracle.sol Line: 203

         function unpause() external onlyRole(PAUSER_ROLE) {

L-2: Literal Instead of Constant

Define and use constant variables instead of using literals. If the same constant literal value is used multiple times, create a constant state variable and reference it throughout the contract.

4 Found Instances

  • Found in src/libraries/PriceLoomMath.sol Line: 16

                 return (uint256(1) << 255);

  • Found in src/libraries/PriceLoomMath.sol Line: 25

                 uint256 ua = uint256(a) ^ (uint256(1) << 255);

  • Found in src/libraries/PriceLoomMath.sol Line: 26

                 uint256 ub = uint256(b) ^ (uint256(1) << 255);

  • Found in src/libraries/PriceLoomMath.sol Line: 46

                 if (mu == (uint256(1) << 255)) return type(int256).min;

L-3: Large Numeric Literal

Large literal values multiples of 10000 can be replaced with scientific notation.Use e notation, for example: 1e18, instead of its full numeric value.

1 Found Instances

  • Found in src/oracle/PriceLoomOracle.sol Line: 605

             return OZMath.mulDiv(diff, 10_000, lastAbs) >= uint256(cfg.deviationBps);

L-4: Loop Contains require/revert

Avoid require / revert statements in a loop because a single bad item can cause the whole transaction to fail. It's better to forgive on fail and return failed elements post processing of the loop

2 Found Instances

  • Found in src/oracle/PriceLoomOracle.sol Line: 131

                 for (uint8 i = 0; i < operators.length; i++) {

  • Found in src/oracle/PriceLoomOracle.sol Line: 428

             for (uint256 i = 0; i < subs.length; i++) {

L-5: Costly operations inside loop

Invoking SSTORE operations in loops may waste gas. Use a local variable to hold the loop computation result.

3 Found Instances

  • Found in src/oracle/PriceLoomOracle.sol Line: 131

                 for (uint8 i = 0; i < operators.length; i++) {

  • Found in src/oracle/PriceLoomOracle.sol Line: 428

             for (uint256 i = 0; i < subs.length; i++) {

  • Found in src/oracle/PriceLoomOracle.sol Line: 531

             for (uint8 i = 0; i < submissionCount; i++) {

L-6: Unchecked Return

Function returns a value but it is ignored. Consider checking the return value.

6 Found Instances

  • Found in src/oracle/PriceLoomOracle.sol Line: 108

             _grantRole(DEFAULT_ADMIN_ROLE, admin);

  • Found in src/oracle/PriceLoomOracle.sol Line: 109

             _grantRole(PAUSER_ROLE, admin);

  • Found in src/oracle/PriceLoomOracle.sol Line: 110

             _grantRole(FEED_ADMIN_ROLE, admin);

  • Found in src/oracle/PriceLoomOracle.sol Line: 318

             _handleTimeoutIfNeeded(feedId);

  • Found in src/oracle/PriceLoomOracle.sol Line: 341

             _handleTimeoutIfNeeded(feedId);

  • Found in src/oracle/PriceLoomOracle.sol Line: 393

             _handleTimeoutIfNeeded(feedId);