MChef smart contract security audit report performed by Callisto Security Audit Department
Contract commit 578705b62cbe1b48d9f4a029eac518d850259d04
In total, 5 issues were reported including:
-
0 high severity issues.
-
1 medium severity issues.
-
2 low severity issues.
-
2 notes.
No critical security issues were found.
Lack of transaction handling mechanism issue. WARNING! This is a very common issue and it already caused millions of dollars losses for lots of token users! More details here.
Add the following code to the transfer(address recipient, ...) function:
require( recipient != address(this) );
In the function setRewardsValue() there is parameter months but it's not using in the function logic.
If function bonusPendingToken() calling not by _user it will return wrong result. Because it use msg.sender to get UserInfo.
At line 1324 use this code:
UserInfo storage user = userInfo[_pid][_user];
The function massUpdatePools() updates every existing pool. It will use many gas if will be many pools. This function is calling from others functions: add(), set() (it's possible not update pools from them), updateRewardPerBlock(), setRewardsValue(), updateRewardsValue(), so Gas usage will be high i those functions too.
However, using massUpdatePools() in the functions setRewardsValue(), updateRewardsValue() is not required and may be removed from them.
The function safeRewardTokenTransfer() transfer tokens from rewardSender address to user. But in case there is not enough tokens or rewardSender did not approve transfers the transaction will be reverted.
This function calls from deposit() and withdraw() functions. Therefore it will be reverted too in that cases.
Use safeRewardTokenTransfer() like this:
function safeRewardTokenTransfer(address _to, uint256 _amount) internal {
if (IERC20(token).balanceOf(rewardSender) >= _amount && IERC20(token).allowance(rewardSender, address(this)) >= _amount)
IERC20(token).transferFrom(rewardSender, _to, _amount);
}The audited smart contract must not be deployed. Reported issues must be fixed prior to the usage of this contract.