fix: coinfabrik-audit-auto-alex-v3

clarity/contracts/auto-token/auto-alex-v3-1-endpoint.clar

@@ -16,10 +16,9 @@
 (define-constant ONE_8 u100000000)
 (define-constant REWARD-CYCLE-INDEXES (list u1 u2 u3 u4 u5 u6 u7 u8 u9 u10 u11 u12 u13 u14 u15 u16 u17 u18 u19 u20 u21 u22 u23 u24 u25 u26 u27 u28 u29 u30 u31 u32))
 (define-data-var contract-owner principal tx-sender)
-(define-map approved-contracts principal bool)
 (define-data-var create-paused bool true)
 (define-data-var redeem-paused bool true)
-(define-constant redeem-delay-cycles u32)
+(define-constant max-cycles u32)
 (define-read-only (get-contract-owner)
   (var-get contract-owner))
 (define-read-only (get-pending)
@@ -66,10 +65,6 @@
   (begin
     (try! (check-is-owner))
     (ok (var-set contract-owner owner))))
-(define-public (set-approved-contract (owner principal) (approved bool))
-	(begin
-		(try! (check-is-owner))
-		(ok (map-set approved-contracts owner approved))))
 (define-public (pause-create (pause bool))
   (begin
     (try! (check-is-owner))
@@ -109,7 +104,7 @@
       (sender tx-sender))
     (asserts! (> intrinsic-dx u0) ERR-INVALID-LIQUIDITY)
     (asserts! (not (is-create-paused)) ERR-PAUSED)
-    (asserts! (< end-cycle-v2 (+ current-cycle u32)) ERR-END-CYCLE-V2) ;; auto-alex-v2 is not configured correctly
+    (asserts! (< end-cycle-v2 (+ current-cycle max-cycles)) ERR-END-CYCLE-V2) ;; auto-alex-v2 is not configured correctly
     ;; transfer dx to contract to stake for max cycles
     (try! (contract-call? .auto-alex-v2 transfer-fixed dx sender .auto-alex-v3-1 none))
     (and (< end-cycle-v2 current-cycle) (begin (as-contract (try! (reduce-position-v2))) true))
@@ -120,7 +115,7 @@
 (define-public (claim-and-mint (reward-cycles (list 200 uint)))
   (let (
       (claimed (unwrap-panic (contract-call? .staking-helper claim-staking-reward .age000-governance-token reward-cycles))))
-    (try! (add-to-position (fold sum-claimed claimed u0)))
+    (try! (add-to-position (try! (fold sum-claimed claimed (ok u0)))))
     (ok claimed)))
 (define-public (claim-and-stake (reward-cycle uint))
   (let (
@@ -142,7 +137,7 @@
 (define-public (request-redeem (amount uint))
   (let (
       (current-cycle (unwrap! (get-reward-cycle block-height) ERR-STAKING-NOT-AVAILABLE))
-      (redeem-cycle (+ current-cycle redeem-delay-cycles))
+      (redeem-cycle (+ current-cycle max-cycles))
       (request-details { requested-by: tx-sender, shares: amount, redeem-cycle: redeem-cycle, status: (get-pending) }))
     (asserts! (not (is-redeem-paused)) ERR-PAUSED)
     (try! (contract-call? .auto-alex-v3-1 transfer-fixed amount tx-sender .auto-alex-v3-1 none))
@@ -155,7 +150,7 @@
       (redeem-cycle (get redeem-cycle request-details))
       (check-claim-and-stake (and (not (is-cycle-staked redeem-cycle)) (try! (claim-and-stake redeem-cycle))))
       (current-cycle (try! (rebase)))
-      (redeem-tokens (div-down (mul-down (get shares request-details) (get-redeem-tokens-per-cycle-or-default redeem-cycle)) (get-redeem-shares-per-cycle-or-default redeem-cycle)))
+      (redeem-tokens (/ (* (get shares request-details) (get-redeem-tokens-per-cycle-or-default redeem-cycle)) (get-redeem-shares-per-cycle-or-default redeem-cycle)))
       (updated-request-details (merge request-details { status: (get-finalized) })))
     (asserts! (not (is-redeem-paused)) ERR-PAUSED)
     (asserts! (is-eq (get-pending) (get status request-details)) ERR-REQUEST-FINALIZED-OR-REVOKED)
@@ -178,20 +173,18 @@
     (as-contract (contract-call? .auto-alex-v3-1-registry set-redeem-request request-id updated-request-details))))
 (define-private (check-is-owner)
   (ok (asserts! (is-eq tx-sender (var-get contract-owner)) ERR-NOT-AUTHORIZED)))
-(define-private (check-is-approved)
-  (ok (asserts! (or (default-to false (map-get? approved-contracts tx-sender)) (is-ok (check-is-owner))) ERR-NOT-AUTHORIZED)))
-(define-private (sum-claimed (claimed-response (response (tuple (entitled-token uint) (to-return uint)) uint)) (sum-so-far uint))
-  (match claimed-response
-    claimed (+ sum-so-far (get to-return claimed) (get entitled-token claimed))
-    err sum-so-far))
+(define-private (sum-claimed (claimed-response (response (tuple (entitled-token uint) (to-return uint)) uint)) (prior (response uint uint)))
+  (match prior 
+    ok-value (match claimed-response claimed (ok (+ ok-value (get to-return claimed) (get entitled-token claimed))) err (err err))
+    err-value (err err-value)))
 (define-private (stake-tokens-iter (cycles-to-stake uint) (previous-response (response { current-cycle: uint, remaining: uint } uint)))
   (match previous-response
     ok-value
     (let (
       (reward-cycle (+ (get current-cycle ok-value) cycles-to-stake))
       (redeeming (get-shares-to-tokens (get-redeem-shares-per-cycle-or-default reward-cycle)))
       (returning (get to-return (get-staker-at-cycle reward-cycle)))
-      (staking (if (is-eq cycles-to-stake u32)
+      (staking (if (is-eq cycles-to-stake max-cycles)
         (get remaining ok-value)
         (if (> returning redeeming)
           u0

clarity/contracts/auto-token/auto-alex-v3-1-wrapped.clar

@@ -2,24 +2,19 @@
 (define-constant ERR-NOT-AUTHORIZED (err u1000))
 (define-constant ONE_8 u100000000)
 (define-data-var contract-owner principal tx-sender)
-(define-map approved-contracts principal bool)
 (define-data-var token-name (string-ascii 32) "Wrapped Auto ALEX v3")
-(define-data-var token-symbol (string-ascii 10) "watALEXv3")
+(define-data-var token-symbol (string-ascii 32) "watALEXv3")
 (define-data-var token-uri (optional (string-utf8 256)) (some u"https://cdn.alexlab.co/metadata/auto-alex-v3-wrapped.json"))
 (define-data-var token-decimals uint u8)
 (define-public (set-contract-owner (owner principal))
   (begin
     (try! (check-is-owner))
     (ok (var-set contract-owner owner))))
-(define-public (set-approved-contract (owner principal) (approved bool))
-	(begin
-		(try! (check-is-owner))
-		(ok (map-set approved-contracts owner approved))))
 (define-public (set-name (new-name (string-ascii 32)))
 	(begin
 		(try! (check-is-owner))
 		(ok (var-set token-name new-name))))
-(define-public (set-symbol (new-symbol (string-ascii 10)))
+(define-public (set-symbol (new-symbol (string-ascii 32)))
 	(begin
 		(try! (check-is-owner))
 		(ok (var-set token-symbol new-symbol))))
@@ -31,13 +26,13 @@
 	(begin
 		(try! (check-is-owner))
 		(ok (var-set token-uri new-uri))))
-(define-public (transfer (amount uint) (sender principal) (recipient principal) (memo (optional (buff 2048))))
+(define-public (transfer (amount uint) (sender principal) (recipient principal) (memo (optional (buff 34))))
 	(begin
 		(asserts! (or (is-eq tx-sender sender) (is-eq contract-caller sender)) ERR-NOT-AUTHORIZED)
 		(try! (ft-transfer? auto-alex-v3-wrapped amount sender recipient))
 		(print { type: "transfer", amount: amount, sender: sender, recipient: recipient, memo: memo })
 		(ok true)))
-(define-public (transfer-fixed (amount uint) (sender principal) (recipient principal) (memo (optional (buff 2048))))
+(define-public (transfer-fixed (amount uint) (sender principal) (recipient principal) (memo (optional (buff 34))))
     (transfer amount sender recipient memo))
 (define-public (mint (amount uint) (recipient principal))
 	(begin 
@@ -73,7 +68,7 @@
 (define-read-only (get-total-shares)
 	(contract-call? .auto-alex-v3-1 get-balance (as-contract tx-sender)))
 (define-read-only (get-tokens-to-shares (amount uint))
-	(if (is-eq (get-total-supply) (ok u0))
+	(if (is-eq (get-total-shares) (ok u0))
 		amount
 		(/ (* amount (unwrap-panic (get-total-supply))) (unwrap-panic (get-total-shares)))))
 (define-read-only (get-shares-to-tokens (shares uint))
@@ -82,6 +77,4 @@
 		(/ (* shares (unwrap-panic (get-total-shares))) (unwrap-panic (get-total-supply)))))
 (define-private (check-is-owner)
   (ok (asserts! (is-eq tx-sender (var-get contract-owner)) ERR-NOT-AUTHORIZED)))
-(define-private (check-is-approved)
-  (ok (asserts! (default-to false (map-get? approved-contracts tx-sender)) ERR-NOT-AUTHORIZED)))
 (contract-call? .alex-vault-v1-1 set-approved-token .auto-alex-v3-1-wrapped true)

clarity/contracts/auto-token/auto-alex-v3-1.clar

@@ -5,7 +5,7 @@
 (define-data-var contract-owner principal tx-sender)
 (define-map approved-contracts principal bool)
 (define-data-var token-name (string-ascii 32) "Auto ALEX v3")
-(define-data-var token-symbol (string-ascii 10) "atALEXv3")
+(define-data-var token-symbol (string-ascii 32) "atALEXv3")
 (define-data-var token-uri (optional (string-utf8 256)) (some u"https://cdn.alexlab.co/metadata/auto-alex-v3.json"))
 (define-data-var token-decimals uint u8)
 (define-data-var reserve uint u0)
@@ -21,7 +21,7 @@
 	(begin
 		(try! (check-is-owner))
 		(ok (var-set token-name new-name))))
-(define-public (set-symbol (new-symbol (string-ascii 10)))
+(define-public (set-symbol (new-symbol (string-ascii 32)))
 	(begin
 		(try! (check-is-owner))
 		(ok (var-set token-symbol new-symbol))))
@@ -100,15 +100,15 @@
 	(if (is-eq (get-total-shares) (ok u0))
 		shares
 		(/ (* shares (unwrap-panic (get-reserve))) (unwrap-panic (get-total-shares)))))
-(define-public (transfer (amount uint) (sender principal) (recipient principal) (memo (optional (buff 2048))))
+(define-public (transfer (amount uint) (sender principal) (recipient principal) (memo (optional (buff 34))))
 	(let (
 			(shares (get-tokens-to-shares amount)))
 		(asserts! (or (is-eq tx-sender sender) (is-eq contract-caller sender)) ERR-NOT-AUTHORIZED)
 		(try! (ft-transfer? auto-alex-v3 shares sender recipient))
 		(match memo to-print (print to-print) 0x)
 		(print { notification: "transfer", payload: { amount: amount, shares: shares, sender: sender, recipient: recipient } })
 		(ok true)))
-(define-public (transfer-fixed (amount uint) (sender principal) (recipient principal) (memo (optional (buff 2048))))
+(define-public (transfer-fixed (amount uint) (sender principal) (recipient principal) (memo (optional (buff 34))))
 	(transfer amount sender recipient memo))
 (define-private (burn-many-iter (item {amount: uint, sender: principal}))
 	(burn (get amount item) (get sender item)))

clarity/contracts/auto-token/auto-alex-v3-2-endpoint.clar

@@ -22,14 +22,13 @@
 ;;
 
 (define-data-var contract-owner principal tx-sender)
-(define-map approved-contracts principal bool)
 
 (define-data-var create-paused bool true)
 (define-data-var redeem-paused bool true)
 
 ;; __IF_MAINNET__
-(define-constant redeem-delay-cycles u32)
-;; (define-constant redeem-delay-cycles u2)
+(define-constant max-cycles u32)
+;; (define-constant max-cycles u2)
 ;; __ENDIF__
 
 ;; read-only calls
@@ -98,11 +97,6 @@
     (try! (check-is-owner))
     (ok (var-set contract-owner owner))))
 
-(define-public (set-approved-contract (owner principal) (approved bool))
-	(begin
-		(try! (check-is-owner))
-		(ok (map-set approved-contracts owner approved))))
-
 (define-public (pause-create (pause bool))
   (begin
     (try! (check-is-owner))
@@ -151,7 +145,7 @@
 (define-public (claim-and-mint (reward-cycles (list 200 uint)))
   (let (
       (claimed (unwrap-panic (contract-call? .staking-helper claim-staking-reward .age000-governance-token reward-cycles))))
-    (try! (add-to-position (fold sum-claimed claimed u0)))
+    (try! (add-to-position (try! (fold sum-claimed claimed (ok u0)))))
     (ok claimed)))  
 
 ;; @desc add to position
@@ -177,7 +171,7 @@
       (sender tx-sender))
     (asserts! (> intrinsic-dx u0) ERR-INVALID-LIQUIDITY)
     (asserts! (not (is-create-paused)) ERR-PAUSED)
-    (asserts! (< end-cycle-v2 (+ current-cycle u32)) ERR-END-CYCLE-V2) ;; auto-alex-v2 is not configured correctly
+    (asserts! (< end-cycle-v2 (+ current-cycle max-cycles)) ERR-END-CYCLE-V2) ;; auto-alex-v2 is not configured correctly
     (try! (contract-call? .auto-alex-v2 transfer-fixed dx sender .auto-alex-v3-2 none))
     (and (< end-cycle-v2 current-cycle) (begin (as-contract (try! (reduce-position-v2))) true))
     (as-contract (try! (contract-call? .auto-alex-v3-2 mint-fixed intrinsic-dx sender)))
@@ -187,7 +181,7 @@
 (define-public (request-redeem (amount uint))
   (let (
       (current-cycle (try! (rebase)))
-      (redeem-cycle (+ current-cycle redeem-delay-cycles))
+      (redeem-cycle (+ current-cycle max-cycles))
       (request-details { requested-by: tx-sender, amount: amount, redeem-cycle: redeem-cycle, status: (get-pending) }))
     (asserts! (not (is-redeem-paused)) ERR-PAUSED)
     (try! (contract-call? .auto-alex-v3-2 transfer-fixed amount tx-sender .auto-alex-v3-2 none))
@@ -235,13 +229,10 @@
 (define-private (check-is-owner)
   (ok (asserts! (is-eq tx-sender (var-get contract-owner)) ERR-NOT-AUTHORIZED)))
 
-(define-private (check-is-approved)
-  (ok (asserts! (or (default-to false (map-get? approved-contracts tx-sender)) (is-ok (check-is-owner))) ERR-NOT-AUTHORIZED)))
-
-(define-private (sum-claimed (claimed-response (response (tuple (entitled-token uint) (to-return uint)) uint)) (sum-so-far uint))
-  (match claimed-response
-    claimed (+ sum-so-far (get to-return claimed) (get entitled-token claimed))
-    err sum-so-far))
+(define-private (sum-claimed (claimed-response (response (tuple (entitled-token uint) (to-return uint)) uint)) (prior (response uint uint)))
+  (match prior 
+    ok-value (match claimed-response claimed (ok (+ ok-value (get to-return claimed) (get entitled-token claimed))) err (err err))
+    err-value (err err-value)))
 
 (define-private (stake-tokens-iter (cycles-to-stake uint) (previous-response (response { current-cycle: uint, remaining: uint } uint)))
   (match previous-response
@@ -250,7 +241,7 @@
       (reward-cycle (+ (get current-cycle ok-value) cycles-to-stake))
       (redeeming (get-shares-to-tokens (get-redeem-shares-per-cycle-or-default reward-cycle)))
       (returning (get to-return (get-staker-at-cycle reward-cycle)))
-      (staking (if (is-eq cycles-to-stake u32)
+      (staking (if (is-eq cycles-to-stake max-cycles)
         (get remaining ok-value)
         (if (> returning redeeming)
           u0

clarity/contracts/auto-token/auto-alex-v3-2-wrapped.clar

@@ -6,10 +6,9 @@
 (define-constant token-decimals u8)
 
 (define-data-var contract-owner principal tx-sender)
-(define-map approved-contracts principal bool)
 
 (define-data-var token-name (string-ascii 32) "vLiALEX")
-(define-data-var token-symbol (string-ascii 10) "vLiALEX")
+(define-data-var token-symbol (string-ascii 32) "vLiALEX")
 (define-data-var token-uri (optional (string-utf8 256)) (some u"https://cdn.alexlab.co/metadata/auto-alex-v3-wrapped.json"))
 
 ;; governance functions
@@ -19,17 +18,12 @@
     	(try! (check-is-owner))
     	(ok (var-set contract-owner owner))))
 
-(define-public (set-approved-contract (owner principal) (approved bool))
-	(begin
-		(try! (check-is-owner))
-		(ok (map-set approved-contracts owner approved))))
-
 (define-public (set-name (new-name (string-ascii 32)))
 	(begin
 		(try! (check-is-owner))
 		(ok (var-set token-name new-name))))
 
-(define-public (set-symbol (new-symbol (string-ascii 10)))
+(define-public (set-symbol (new-symbol (string-ascii 32)))
 	(begin
 		(try! (check-is-owner))
 		(ok (var-set token-symbol new-symbol))))
@@ -41,14 +35,14 @@
 
 ;; public functions
 
-(define-public (transfer (amount uint) (sender principal) (recipient principal) (memo (optional (buff 2048))))
+(define-public (transfer (amount uint) (sender principal) (recipient principal) (memo (optional (buff 34))))
 	(begin
 		(asserts! (or (is-eq tx-sender sender) (is-eq contract-caller sender)) ERR-NOT-AUTHORIZED)
 		(try! (ft-transfer? auto-alex-v3-wrapped amount sender recipient))
 		(print { type: "transfer", amount: amount, sender: sender, recipient: recipient, memo: memo })
 		(ok true)))
 
-(define-public (transfer-fixed (amount uint) (sender principal) (recipient principal) (memo (optional (buff 2048))))
+(define-public (transfer-fixed (amount uint) (sender principal) (recipient principal) (memo (optional (buff 34))))
     (transfer amount sender recipient memo))
 
 (define-public (mint (amount uint) (recipient principal))
@@ -105,7 +99,7 @@
 	(contract-call? .auto-alex-v3-2 get-balance (as-contract tx-sender)))
 
 (define-read-only (get-tokens-to-shares (amount uint))
-	(if (is-eq (get-total-supply) (ok u0))
+	(if (is-eq (get-total-shares) (ok u0))
 		amount
 		(/ (* amount (unwrap-panic (get-total-supply))) (unwrap-panic (get-total-shares)))))
 
@@ -119,7 +113,4 @@
 (define-private (check-is-owner)
   (ok (asserts! (is-eq tx-sender (var-get contract-owner)) ERR-NOT-AUTHORIZED)))
 
-(define-private (check-is-approved)
-  (ok (asserts! (default-to false (map-get? approved-contracts tx-sender)) ERR-NOT-AUTHORIZED)))
-
 (contract-call? .alex-vault-v1-1 set-approved-token .auto-alex-v3-2-wrapped true)

clarity/contracts/auto-token/auto-alex-v3-2.clar

@@ -11,7 +11,7 @@
 (define-map approved-contracts principal bool)
 
 (define-data-var token-name (string-ascii 32) "LiALEX")
-(define-data-var token-symbol (string-ascii 10) "LiALEX")
+(define-data-var token-symbol (string-ascii 32) "LiALEX")
 (define-data-var token-uri (optional (string-utf8 256)) (some u"https://cdn.alexlab.co/metadata/auto-alex-v3.json"))
 
 (define-data-var reserve uint u0)
@@ -33,7 +33,7 @@
 		(try! (check-is-owner))
 		(ok (var-set token-name new-name))))
 
-(define-public (set-symbol (new-symbol (string-ascii 10)))
+(define-public (set-symbol (new-symbol (string-ascii 32)))
 	(begin
 		(try! (check-is-owner))
 		(ok (var-set token-symbol new-symbol))))
@@ -138,7 +138,7 @@
 
 ;; public calls
 
-(define-public (transfer (amount uint) (sender principal) (recipient principal) (memo (optional (buff 2048))))
+(define-public (transfer (amount uint) (sender principal) (recipient principal) (memo (optional (buff 34))))
 	(let (
 			(shares (get-tokens-to-shares amount)))
 		(asserts! (or (is-eq tx-sender sender) (is-eq contract-caller sender)) ERR-NOT-AUTHORIZED)
@@ -147,7 +147,7 @@
 		(print { notification: "transfer", payload: { amount: amount, shares: shares, sender: sender, recipient: recipient } })
 		(ok true)))
 
-(define-public (transfer-fixed (amount uint) (sender principal) (recipient principal) (memo (optional (buff 2048))))
+(define-public (transfer-fixed (amount uint) (sender principal) (recipient principal) (memo (optional (buff 34))))
 	(transfer amount sender recipient memo))
 
 ;; private functions