A place for developers to talk about building on Farcaster.

/dev

If you're a Solidity dev and interested in helping out Degen by auditing or reviewing our Locked Degen ERC-20 contract, we'd love your support. Your help in finding bugs or suggesting code improvements would be greatly appreciated! Thanks!

If you're a Solidity dev and interested in helping out Degen by auditing or reviewing our Locked Degen ERC-20 contract, we'd love your support. Your help in finding bugs or suggesting code improvements would be greatly appreciated! Thanks!

https://github.com/degen-token/degen-smart-contracts/pull/22

some people is asking about it.. and I had to stop my audit.. after found it..

LN 130 - updateLockDuration() function 
This allow the owner to change the locking period.. between 0-365 days.

LN 118 - if (block.timestamp <= depositTimestamps[msg.sender] + lockDuration) revert...

This check on lockDuration in the withdraw function allows the owner to do some tricks with the locking period: 
 - the owner could lock and unlock by managing to do a sandwich: updateLockFunction-withdraw-updateLockFunction, withdrawing without respecting the lock. And, setting it again locking users funds.
- the owner could extend the locking period, from an initial 0 days to 1 year. Locking user funds for 1 year without user "permission".

Alchemist. 
Block Builder. 
Creator.
Degen. 
Ethereum dev. 
Farcaster Framer.

LN 59-62

    /**
     *  @dev Amount of tokens to be locked is zero
     */
    error ZeroAmount();
    
This comment does not represent the functionality. This error is thrown when the amount to WITHDRAW is 0 and has nothing to do with the amount of tokens to be locked.

this is a base Sepolia address, confirmed,

LN 31-32 
    IERC20 public constant TOKEN =
        IERC20(0xfee293840D23B0B2De8C55e1Cf7A9F01C157767c);
        
the address should be DEGEN token address!? (I guess it is okay for testing?)

Husband, dad, dev • @dune.eth wizard • Ultimate Ⓜ️oxie Dashboard https://tinyurl.com/moxiedash •  I'm just zis guy, you know?

1. Owner can control other users lockDuration.
This means that anyone could lock a great amount and being allied with the owner would be able to withdraw while others could not.. (this is not fair)
and,
this add the ability to create a fake trust and reputation, and then, withdraw the funds.. this is like a pump and dump.. for staking.. (sound bad)
(being in control of treasury does not mean that we should continue doing things this way.. having better and fair methods..to do that.. imo)

2. Conditions of a contract should not change in the middle of the contract without both parties signing it again. In this case should explain to users that they lock could change whenever the admin wants from 0 to 365.

IMO

1 is not an issue because the owner already controls the entire treasury and users have no expectation of the owner locking anything, nor does it impact user funds (could change if e.g. owner says I'm locking for a year you should too! )

2 I also pointed out and users should definitely be mad aware of the risk, ideally shouldn't be possible

Systems engineer, 10K/half-marathon runner, /appreciation mod /receipts

Hey J-V!  Tipping you on behalf of Jacek 😄🎭
1700 $DEGEN

I knew you where cool but not so cool bro 😎

This is a fair point. I was considering that in the future we might vote on adjusting the lock duration. However, I think a better approach is to launch separate contracts with different lock periods, such as 1 year and 3 months, based on demand. We'll also modify the lock duration function so that it can only be reduced. If we need to reduce the lock period to 0, it will apply to all users, and there will be no way to increase it again.

LOL
(agreed, this season is being "rare")

No need for tips but they are appreciated 🎩 

In addition, I have found the contract very simple and with no extra complications, it does exactly what it needs to do and nothing more, and it is following battle tested standards like the reentrant modifier to protect against reentrancy attacks. Feels safe.

Also, once the new season kicks off, I'll tip you. I've fallen behind on my tipping lately, and now I'm down to a 5-tip limit, lol. This season seriously needs an upgrade. Sending 5 $DEGEN for now.

5 $degen

because of the great job, but mostly because it is probably the only chance ever that my tip = @jacek tip

😂 🤣 😂 🤣 😂 🤣 😂 🤣 😂 🤣

Whoa you did a damn great job. 

5500 $DEGEN

thank you so much 🎩

you are awesome too, 1618 $DEGEN

intersubjective mechanism design @ poidh.xyz - come chill /poidh + follow @poidhbot