[WP-H13] MasterChef.sol Users won't be able to receive the concur rewards

Lines of code Vulnerability details According to: README Implementation of deposit: /contracts/MasterChef.solL157-L180 MasterChef is only recording the deposited amount in the states, it's not actually holding the depositToken. depositToken won't be transferred from msgSender to the MasterChef...

check for deposit token and reward token are not same

Handle hack3r-0m Vulnerability details Impact createStream does not check if deposit token and reward token are different addresses. Proof of Concept Not Required Tools Used Manual Review Recommended Mitigation Steps add check requirerewardToken != depositToken --- The text was updated...

Public variable unstreamed can be smaller than ∑ts.tokens due to unstreamed not being updated in withdraw()

Handle WatchPug Vulnerability details unstreamed is a public variable, and it's been actively managed in stake, updateStreamInternal. However, since users can also withdraw unstreamed depositToken, the global variable unstreamed should be updated in withdraw as well. For example: 1. Alice deposit...

Broken logic if rewardToken == depositToken

Handle gzeon Vulnerability details Impact There doesn't seems to be anything to prevent one the deploy a Stream with rewardToken == depositToken. If rewardToken == depositToken, some logic might be broken. Proof of Concept For example, 1. recoverTokens logic would be broken because it does not...

depositToken != rewardToken

Handle pauliax Vulnerability details Impact function createStream should validate that depositToken != rewardToken, otherwise, some functionality may not work as intended, e.g. in function recoverTokens it will become impossible to reach the second 'if' statement. Recommended Mitigation Steps...

Locke.sol:Stream - recoverTokens can bork depositToken balance

Handle ScopeLift Vulnerability details Impact if there's been a flashloan which adds to depositTokenFlashloanFeeAmount which gov can then collect but then recoverTokens is called before governor calls claimFees, then depositToken.balanceOfaddressthis is gonna be off by...

Locke.sol:Stream - arbitraryCall can be used to drain incentive tokens

Handle ScopeLift Vulnerability details Impact Governor can drain incentive balance via arbitraryCall Proof of Concept The Stream contract offers createIncentive and claimIncentive which is the way the contract "expects" incentives to go. Access to claiming incentives is limited to the stream...

onlyOwnerOrAssetManager can swap Yield Source in SwappableYieldSource at any time, immediately rugging all funds from old yield source

Handle GalloDaSballo Vulnerability details Impact The function swapYieldSource Can be called by the owner deployer / initializer or Asset Manager The function will take all funds from the old Yield Source, and transfer them to the new Yield source. Any contract that implement the function functio...