EXECUTIVE SUMMARY
Gold Digger is a yield farm (or ROI dApp) decentralized application where investors deposit funds to get periodic earnings. Even though the contract refers to itself as a miner, it does not use a sub-token and acts as a fairly simple ROI dApp.
It's recommended that users review this report in its entirety to fully understand the application's fundamentals and risks.
We found a critical security issue allowing any user to drain the contract balance, and was resolved by the deployer team shortly.
SCOPE
FUNDAMENTALS
This is a basic ROI dApp where users can invest BNB, accumulate earnings as gold and pickaxe, reinvest one or the other (which gives flexibility to investment management), and withdraw as BNB. The maximum deposit value per investor depends on how much time has gone since the launch date (or first deposit of the contract).
The first deposit initiates the contract and defines the launch date of the contract.
Fees (on deposit):
Gold & Pickaxe:
Referral:
Interest rate:
Maximum deposit value:
Compounding (reinvest):
FINDINGS
| INTERACTION | SEVERITY |
|---|---|
| [CPFC-1] null address referrer allows infinite earnings | RESOLVED |
| [CPFI-1] total investors incorrect incrementation | INFORMATIVE |
CPFC-1: On HireMiner(), the investor's percentage increases to the initial interest rate, but increases indefinitely if no referrer is set, allowing the TVL to be drained by any user. This issue was fixed by the deployer team.
CPFI-1: On deposit, the number of total investors increases by 1, but does not check if the depositor has already deposited in the past, thus the increase does not reflect the actual number of investor, but rather the number of deposits. Since this is only for statistics, this is considered as informative and harmless.
UNIT TESTS
| INTERACTION | RESULT |
|---|---|
| [CPUT-1] deposit | OK |
| [CPUT-2] withdraw | OK |
| [CPUT-3] compounding | OK |
| [CPUT-4] referrals | OK |
| [CPUT-5] interest rate | OK |
Unit testing was conducted to verify possible exploits, validate the logic, and ensure it aligns with the project's fundamentals. It was done so successfully.
PRIVILEGES
There is no privilege. On deployment, ownership is renounced.
RECOMMENDATIONS
Calling _msgSender() is only useful to take into consideration gas-free metadata transactions, which is not of use with such a smart contract. If anything, it adds 22,000 gas each time it is called, which increases the gas cost significantly as it is repeatedly called in multiple functions, instead of msg.sender.
Repeated direct mapping entry updates without using storage pointers significantly increase gas cost.
Msg.sender == tx.origin protection is used in most functions of the contract; while it improves the security of the contract, it effectively breaks interoperability by preventing other smart contracts from interacting with GoldDigger. This can be left as is with no issue however as it is still a nice security feature.
There is a loss of precision by a magnitude of 1000 because of a reverse operation order on percentage computation, on feepickaxe inside _traverseTree(), feepickaxe on HireMiner(), and a magnitude of 10,000,000,000 inside of checkReward(), this would reduce expected earnings so that is only a technical detail.
We recommend a maximum earnings accumulation cutoff to improve solvency of the game theory behind the contract and a maximum value withdrawn.