Beedle - Oracle free perpetual lending
BeedleFi
DeFiFoundry
20,000 USDC
View results
Previous Next
Submission Details
Severity: gas
Valid

Constants should be defined rather than using magic numbers

codeslide

Summary

The term "magic number" refers to the anti-pattern of using numbers directly in source code. This has been referred to as breaking one of the oldest rules of programming.

Vulnerability Details

There are 12 instances of this issue.

View 12 Instances
File: src/Beedle.sol
​
/// @audit 1e18
12: _mint(msg.sender, 1_000_000_000 * 1e18);
File Link Instance Count Instance Link
Beedle.sol 1 12
File: src/Fees.sol
​
/// @audit 3000
34: fee: 3000,
File Link Instance Count Instance Link
Fees.sol 1 34
File: src/Lender.sol
​
/// @audit 5000
85: if (_fee > 5000) revert FeeTooHigh();
​
/// @audit 500
93: if (_fee > 500) revert FeeTooHigh();
​
/// @audit 10000
265: uint256 fees = (debt * borrowerFee) / 10000;
​
/// @audit 10000
561: uint256 govFee = (borrowerFee * loan.collateral) / 10000;
​
/// @audit 10000
650: uint256 fee = (borrowerFee * (debt - debtToPay)) / 10000;
​
/// @audit 10000
724: interest = (l.interestRate * l.debt * timeElapsed) / 10000 / 365 days;
​
/// @audit 365
724: interest = (l.interestRate * l.debt * timeElapsed) / 10000 / 365 days;
​
/// @audit 10000
725: fees = (lenderFee * interest) / 10000;
File Link Instance Count Instance Links
Lender.sol 8 85,93,265,561,650,724,724,725
File: src/Staking.sol
​
/// @audit 1e18
68: uint256 _ratio = _diff * 1e18 / totalSupply;
​
/// @audit 1e18
88: uint256 _share = _supplied * _delta / 1e18;
File Link Instance Count Instance Links
Staking.sol 2 68,88

Impact

The use of unnamed magic numbers in code obscures the developer's intent in choosing that number, increases opportunities for subtle errors, and makes it more difficult for the program to be adapted and extended in the future.

Tools Used

baudit: a custom static code analysis tool; manual review

Recommendations

Replace all significant magic numbers with named constants to make the contracts easier to read, understand, and maintain.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.