<username>{{ maskedUsername }}</username><space /><text>just voted for</text><space /><projectButton />

<username>{{ maskedUsername }}</username><space /><text>just voted for</text><space /><projectLogo /><space /><projectName>{{ projectName }}</projectName>

Bug Bounty rewards are grouped by severity and the impact of the vulnerability. Examples and descriptions of the type of vulnerabilities that correspond to each severity level can be found below. The payout amount has a 5 tier structure with separate scalesfor website/apps and smart contracts.

Description of vulnerability and your proof of concept or validation steps

Name

Please input a title

Short description of the vulnerability and the affected asset.

The core team is situated in country(ies) that received low aggregated ratings in terms of international judicial cooperation, criminal justice system, anti-money laundering, and corruption. This contextual data suggests an increased difficulty and complexity in preventing and mitigating fraud.

The core team is situated in country(ies) that received medium aggregated ratings in terms of international judicial cooperation, criminal justice system, anti-money laundering, and corruption. This contextual data suggests a medium level of geographic accountability, thus reducing and mitigating the risk of fraud.

The core team is situated in country(ies) that received the best aggregated ratings in terms of international judicial cooperation, criminal justice system, anti-money laundering, and corruption. This contextual data suggests the highest level of geographic accountability, thus maximizing the risk reduction and mitigation.

Vulnerability Title

In the contract `Ownable` the role `_owner` has authority over the functions shown in the diagram below.
Any compromise to the `_owner` account may allow the hacker to take advantage of this authority and transfer the ownership to any address.
![](https://accelerator-tasks-prod.s3.amazonaws.com/dafc365c1b904954919c64aed0829ca6/diagrams/centralization_L2Finance-Ownable-_owner.svg)

In the contract `HasNoEther` the role `_owner` has authority over the functions shown in the diagram below.
This centralization risk may lead to a single point of failure and gives the owner significant control over the contract's behavior:
1. `reclaimEther()` - allows the owner to transfer all ether in the contract to the owner.
2. `reclaimToken()` - allows the owner to transfer any type of ERC20 in the contract to the owner.
  
Any compromise to the `_owner` account may allow the hacker to take advantage of this authority and bring unpredictable damages to the project.
![](https://accelerator-tasks-prod.s3.amazonaws.com/dafc365c1b904954919c64aed0829ca6/diagrams/centralization_L2Finance-HasNoEther-_owner.svg)


In the contract `L2Finance` the role `_owner` has authority over the functions shown in the diagram below.
Any compromise to the `_owner` account may allow the hacker to take advantage of this authority and change the `sellBurnFee`, set the `excludeFee`/`_open`/`_key`, set the `_swap` and `_swapAllow` to block certain users from swapping functionality. 
![](https://accelerator-tasks-prod.s3.amazonaws.com/dafc365c1b904954919c64aed0829ca6/diagrams/centralization_L2Finance-L2Finance-_owner.svg)




Centralization Risks in L2Finance.sol

All L2FI tokens are sent to the deployer when deploying the contract. This could be a centralization risk as the deployer can distribute tokens without obtaining the consensus of the community.

Initial Token Distribution

The function `reclaimToken()` can be called by the owner to drain all ERC20 tokens in the contract, including the USDT and the L2FI.
This is both a centralization issue and a logical issue.

Logical issues in reclaimToken function

There are no upper boundaries for **sellBurnFee**. It is possible to set the total fee rate up to any arbitrary amount. 

No Upper Limit for sellBurnFee

When transferring deflationary ERC20 tokens, the input amount may not be equal to the received amount due to the charged transaction fee. For example, if a user sends 100 deflationary tokens (with a 10% transaction fee), only 90 tokens actually arrived to the contract. However, a failure to discount such fees may allow the same user to withdraw 100 tokens from the contract, which causes the contract to lose 10 tokens in such a transaction.

Reference:
https://thoreum-finance.medium.com/what-exploit-happened-today-for-gocerberus-and-garuda-also-for-lokum-ybear-piggy-caramelswap-3943ee23a39f

```solidity=843
        bool success = IERC20(_usdtAddr).transferFrom(_msgSender(), address(this), amountUSDTIn);
```
- Transferring tokens by `amountUSDTIn`.

```solidity=841
        uint256 amountL2FIOut = _getL2FIOut(amountUSDTIn, poolL2FIBal, poolUSDTBal);
```
- This function call executes the following operation.
- In `L2Finance._getL2FIOut`,
    - `uint256 denominator = poolUSDTBal.add(amountUSDTIn);`
- In `SafeMath.add`,
    - `uint256 c = a + b;`
- The `amountUSDTIn` appears to be used for bookkeeping purposes without compensating the potential transfer fees.


---
```solidity=861
        bool success = IERC20(_usdtAddr).transferFrom(_msgSender(), address(this), amountUSDTIn);
```
- Transferring tokens by `amountUSDTIn`.

```solidity=859
        uint256 amountL2FIOut = _getL2FIOut(amountUSDTIn, poolL2FIBal, poolUSDTBal);
```
- This function call executes the following operation.
- In `L2Finance._getL2FIOut`,
    - `uint256 denominator = poolUSDTBal.add(amountUSDTIn);`
- In `SafeMath.add`,
    - `uint256 c = a + b;`
- The `amountUSDTIn` appears to be used for bookkeeping purposes without compensating the potential transfer fees.



Incompatibility with Deflationary Tokens

The return value of the transfer()/transferFrom() call is not checked.

```solidity=531
        IERC20(token).transfer(owner(),amount);
```



Unchecked ERC-20 `transfer()`/`transferFrom()` Call

Addresses should be checked before assignment or external call to make sure they are not zero addresses.

```solidity=599
        _usdtAddr = USDTAddr;
```
- `USDTAddr` is not zero-checked before being used.


---
```solidity=600
        _key = key;
```
- `key` is not zero-checked before being used.


---
```solidity=684
        _key = _value;
```
- `_value` is not zero-checked before being used.



Missing Zero Address Validation

Performing integer division before multiplication truncates the low bits, losing the precision of calculation.

```solidity=727
        uint256 burnAmount = amountL2FIIn.div(1000).mul(sellBurnFee);
```


---
```solidity=820
        uint256 burnedAmount = excludeFee[msg.sender]  ? 0 : amountL2FIIn.div(1000).mul(sellBurnFee);
```



Divide Before Multiply

In the view function `estimatedUSDTOut()`, unlike the function `swapForUSDT`, the `excludeFee` logic is not considered. Hence it might not return accurate values for excludeFee users.

excludeFee not considered

The linked variables assigned in the constructor can be declared as `immutable`. Immutable state variables can be assigned during contract creation but will remain constant throughout the lifetime of a deployed contract. A big advantage of immutable variables is that reading them is significantly cheaper than reading from regular state variables since they will not be stored in storage.

Variables That Could Be Declared as Immutable

The linked statements do not affect the functionality of the codebase.

The contract has to maintain two different mappings: _swap and _swapAllow.
However, they have no obvious differences.

The internal function `_burnFrom()` is defined but never called.

The `reclaimEther()` function is redundant since there is no payable function or receive() function in the contract.

Redundant Statements

L2Finance

L2Finance.sol

L2FINANCE is a one-stop service platform for the financial derivatives market, focusing on six on-chain derivatives including synthetic assets, options, markets prediction, perpetual contracts, insurance, and interest rates. L2FINANCE is committed to promoting the better development of the on-chain derivatives market, allowing more long-tail investors to participate in the development dividends of the on-chain derivatives market!

Leaderboards

Due Diligence Tools

Resources

KYC Status

Bug Bounty Program