uups-checker 1.0.0

package/audits/StakingPool-security-audit-20260324.md

@@ -0,0 +1,517 @@
+# Decompiled Staking Pool Security Audit Report
+
+**Contract**: Unknown Staking Pool (Decompiled)  
+**Type**: Staking/Rewards Distribution Contract  
+**Compiler**: Solidity 0.8.20  
+**Decompiled**: October 1, 2025 by Dedaub  
+**Audit Date**: March 24, 2026  
+**Auditor**: Kiro AI Security Analysis  
+
+---
+
+## Executive Summary
+
+**Risk Level**: 🔴 **CRITICAL**
+
+This decompiled staking pool contract has **SEVERE VULNERABILITIES** including:
+1. **CRITICAL**: Owner can drain all staked tokens at any time
+2. **CRITICAL**: Malicious extension contract can manipulate stakes
+3. **CRITICAL**: Owner can change lockup period, trapping users
+4. **HIGH**: Compound function uses hardcoded Uniswap router
+5. **HIGH**: Rewards redistribution can be exploited
+
+---
+
+## Contract Overview
+
+This is a staking pool where:
+- Users stake ERC20 tokens to earn ETH rewards
+- Rewards are distributed proportionally based on shares
+- Users can claim rewards in ETH or compound them into more tokens
+- Owner has extensive control over contract parameters
+- External "extension" contract is called on every stake/unstake
+- Lockup period prevents early withdrawals
+
+**Key Mechanisms**:
+- Share-based reward distribution (similar to dividend tokens)
+- Cumulative rewards per share calculation
+- Optional auto-compounding via Uniswap V2
+- Batch staking for multiple wallets
+- Reentrancy protection
+
+---
+
+## CRITICAL FINDINGS
+
+### 🔴 CRITICAL #1: Owner Can Drain All Staked Tokens
+**Severity**: CRITICAL - RUG PULL FUNCTION  
+**Function**: `withdrawTokens()`
+
+```solidity
+function withdrawTokens(uint256 amount) public nonPayable {
+    require(msg.sender == _owner, Error('Ownable: caller is not the owner'));
+    if (!amount) {
+        // ❌ If amount is 0, withdraws ALL tokens!
+        v0, v1 = _token.balanceOf(this).gas(msg.gas);
+    }
+    // Transfers tokens to owner
+    _token.transfer(msg.sender, v1);
+}
+```
+
+**THE TRAP**:
+- Owner can call `withdrawTokens(0)` to withdraw ALL tokens
+- This includes ALL user stakes, not just fees
+- No checks, no limits, no timelock
+- Users lose everything instantly
+
+**Impact**:
+- **INSTANT RUG PULL CAPABILITY**
+- Owner can steal all staked tokens at any time
+- No way for users to prevent or recover
+- This is the most dangerous function in the contract
+
+---
+
+### 🔴 CRITICAL #2: Malicious Extension Contract Attack
+**Severity**: CRITICAL  
+**Function**: `setPoolExtension()` + stake/unstake logic
+
+```solidity
+function setPoolExtension(address varg0) public nonPayable {
+    require(msg.sender == _owner, Error('Ownable: caller is not the owner'));
+    _extension = varg0;
+}
+
+// Called on EVERY stake/unstake:
+if (_extension) {
+    require(bool(_extension.code.size));
+    v0 = _extension.setShare(address(varg2), varg1, bool(varg0)).gas(msg.gas);
+}
+```
+
+**The Attack**:
+1. Owner sets malicious extension contract
+2. Extension contract is called on every stake/unstake
+3. Malicious extension can:
+   - Revert to block all stakes/unstakes
+   - Manipulate share calculations
+   - Steal tokens via reentrancy
+   - Front-run user transactions
+   - Log sensitive data
+
+**Impact**:
+- Owner can freeze all staking/unstaking
+- Owner can manipulate reward calculations
+- Extension has unlimited power over staking logic
+- No validation of extension contract behavior
+
+---
+
+### 🔴 CRITICAL #3: Owner Can Change Lockup Period
+**Severity**: CRITICAL  
+**Function**: `setLockupPeriod()`
+
+```solidity
+function setLockupPeriod(uint256 value) public nonPayable {
+    require(msg.sender == _owner, Error('Ownable: caller is not the owner'));
+    require(value < 0x1e13380, Error('lte 1 year')); // Max 1 year
+    _lockupPeriod = value;
+}
+
+// Unstaking checks:
+require(block.timestamp > _@getUnpaid_2231[address(varg1)].field1 + _lockupPeriod, 
+    Error('REM: timelock'));
+```
+
+**The Trap**:
+1. User stakes with 7-day lockup
+2. Owner changes lockup to 365 days
+3. User's tokens are now locked for 1 year
+4. No way to unstake early
+
+**Impact**:
+- Owner can trap users' funds indefinitely (up to 1 year)
+- Lockup period applies to existing stakes retroactively
+- Users have no protection against lockup changes
+- Can be used to prevent mass exodus
+
+---
+
+### 🔴 CRITICAL #4: Rewards Redistribution Exploit
+**Severity**: CRITICAL  
+**Function**: `@_removeShares_1889()`
+
+```solidity
+function @_removeShares_1889(uint256 varg0, uint256 varg1) private {
+    // ... unstaking logic ...
+    
+    v4 = @getUnpaid_2231(varg1); // Get unpaid rewards
+    v5 = _totalSharesDeposited;
+    v6 = _SafeSub(v5, varg0);
+    v7 = v8 = v6 > 0;
+    
+    if (v6 <= 0) {
+        @_distributeReward_2055(0, 0, varg1); // Distribute to user
+    }
+    
+    // ... remove shares ...
+    
+    if (v8) {
+        v7 = v12 = v4 > 0;
+    }
+    if (!v7) {
+        return;
+    } else {
+        @_depositRewards_1940(v4, varg1); // ❌ REDISTRIBUTES REWARDS BACK TO POOL!
+        return;
+    }
+}
+```
+
+**The Bug**:
+- When user unstakes, their unpaid rewards are calculated
+- If total shares > 0 after unstaking, rewards are REDISTRIBUTED to remaining stakers
+- User loses their earned rewards!
+- Rewards go to other stakers instead
+
+**Exploit Scenario**:
+1. Alice stakes 100 tokens, earns 10 ETH in rewards
+2. Bob stakes 100 tokens
+3. Alice unstakes
+4. Alice's 10 ETH rewards are redistributed to Bob
+5. Alice gets nothing, Bob gets Alice's rewards
+
+**This is either a critical bug or intentional theft mechanism.**
+
+---
+
+### 🟡 HIGH #5: Hardcoded Uniswap Router
+**Severity**: HIGH  
+**Function**: `@_compoundRewards_2140()`
+
+```solidity
+function @_compoundRewards_2140(uint256 varg0, uint256 varg1, uint256 varg2) private {
+    // Hardcoded Uniswap V2 Router
+    v1, v2 = address(0x7a250d5630b4cf539739df2c5dacb4c659f2488d).WETH().gas(msg.gas);
+    
+    // Swaps ETH for tokens
+    v13 = address(0x7a250d5630b4cf539739df2c5dacb4c659f2488d)
+        .swapExactETHForTokensSupportingFeeOnTransferTokens(
+            varg0, v6, address(this), block.timestamp, v14, address(v2)
+        ).value(varg1).gas(msg.gas);
+}
+```
+
+**Issues**:
+1. **Hardcoded Router**: Cannot be changed if Uniswap V2 is deprecated
+2. **No Slippage Protection**: Only user-provided minimum (can be 0)
+3. **MEV Vulnerable**: No deadline protection (uses block.timestamp)
+4. **Fee-on-Transfer**: Supports fee tokens but doesn't validate received amount
+5. **No Router Validation**: Assumes router is always available
+
+**Impact**:
+- Compound function can fail if Uniswap V2 is deprecated
+- Users can be sandwiched by MEV bots
+- Slippage can be 100% if user sets minimum to 0
+
+---
+
+### 🟡 HIGH #6: Batch Staking Without Validation
+**Severity**: HIGH  
+**Function**: `stakeForWallets()`
+
+```solidity
+function stakeForWallets(address[] _wallets, uint256[] _amounts) public nonPayable {
+    @_nonReentrantBefore_157();
+    require(_wallets.length == _amounts.length, Error('INSYNC'));
+    
+    v0 = v1 = 0;
+    while (v0 < _wallets.length) {
+        // Stakes for each wallet
+        // Calls extension.setShare() for each
+        // No validation of wallet addresses
+        // No check if msg.sender has enough tokens
+    }
+}
+```
+
+**Issues**:
+1. **No Access Control**: Anyone can call this function
+2. **No Token Balance Check**: Doesn't verify msg.sender has tokens
+3. **Gas Limit Risk**: Large arrays can run out of gas
+4. **No Wallet Validation**: Can stake to zero address or contracts
+
+**Impact**:
+- Function can be used to grief by staking to invalid addresses
+- Can run out of gas and waste user funds
+- No protection against malicious inputs
+
+---
+
+### 🟡 MEDIUM #7: Low-Level Call for ETH Distribution
+**Severity**: MEDIUM  
+**Function**: `@_distributeReward_2055()`
+
+```solidity
+v5, v6 = address(varg2).call().value(v0).gas(msg.gas);
+if (RETURNDATASIZE() != 0) {
+    v7 = new bytes[](RETURNDATASIZE());
+    v6 = v7.data;
+    RETURNDATACOPY(v6, 0, RETURNDATASIZE());
+}
+require(v5, Error('DIST0'));
+```
+
+**Issues**:
+1. **Unlimited Gas**: Sends all available gas to recipient
+2. **Reentrancy Risk**: Recipient can call back into contract
+3. **Contract Recipients**: If recipient is contract with expensive receive(), can fail
+4. **No Gas Limit**: Can be used to drain gas from transaction
+
+**Mitigation**: Has reentrancy guard, but still risky.
+
+---
+
+### 🟡 MEDIUM #8: Reward Calculation Complexity
+**Severity**: MEDIUM  
+**Function**: `@_cumulativeRewards_2246()` + `@getUnpaid_2231()`
+
+```solidity
+function @_cumulativeRewards_2246(uint256 varg0) private {
+    v0 = _SafeMul(varg0, _@_cumulativeRewards_2246);
+    v1 = _SafeDiv(v0, 10 ** 36);
+    return v1;
+}
+
+function @getUnpaid_2231(address varg0) private {
+    if (0 - _@getUnpaid_2231[varg0].field0) {
+        v0 = @_cumulativeRewards_2246(_@getUnpaid_2231[varg0].field0);
+        if (v0 > _rewards[varg0].field0) {
+            v1 = _SafeSub(v0, _rewards[varg0].field0);
+            return v1;
+        }
+    }
+    return 0;
+}
+```
+
+**Complexity**:
+- Uses 10^36 precision multiplier
+- Multiple storage reads per calculation
+- Complex cumulative reward tracking
+- Potential for rounding errors
+
+**Risk**: Accounting bugs could lead to reward miscalculations.
+
+---
+
+### 🟢 POSITIVE #9: Reentrancy Protection
+**Severity**: INFORMATIONAL
+
+```solidity
+function @_nonReentrantBefore_157() private {
+    require(_@_nonReentrantBefore_157 - 2, Error('ReentrancyGuard: reentrant call'));
+    _@_nonReentrantBefore_157 = 2;
+    return;
+}
+```
+
+**Good**: Contract uses OpenZeppelin-style reentrancy guard on critical functions.
+
+---
+
+### 🟢 POSITIVE #10: Safe Math Operations
+**Severity**: INFORMATIONAL
+
+```solidity
+function _SafeAdd(uint256 varg0, uint256 varg1) private {
+    require(varg0 <= varg1 + varg0, Panic(17));
+    return varg1 + varg0;
+}
+```
+
+**Good**: All arithmetic operations use safe math (Solidity 0.8.20 has built-in overflow checks).
+
+---
+
+## Exploitability Assessment
+
+### Can External Attackers Exploit This?
+
+**LIMITED** - External attackers have limited options:
+- Cannot directly steal funds (owner-only functions)
+- Reentrancy is protected
+- Reward calculations are complex but seem correct
+- Batch staking has no access control but requires tokens
+
+### Can Owner Exploit This?
+
+**YES** - Owner has EXTREME power:
+
+1. **Instant Rug Pull**: Call `withdrawTokens(0)` to steal all tokens
+2. **Lockup Trap**: Increase lockup period to trap users
+3. **Malicious Extension**: Deploy extension that blocks unstaking
+4. **Reward Manipulation**: Extension can manipulate share calculations
+5. **Selective Blocking**: Extension can block specific users
+
+---
+
+## Risk Summary
+
+| Risk Category | Level | Details |
+|--------------|-------|---------|
+| **Rug Pull Risk** | 🔴 CRITICAL | Owner can drain all tokens instantly |
+| **Extension Risk** | 🔴 CRITICAL | Malicious extension has unlimited power |
+| **Lockup Manipulation** | 🔴 CRITICAL | Owner can trap users indefinitely |
+| **Reward Redistribution** | 🔴 CRITICAL | Users lose rewards when unstaking |
+| **Compound Function** | 🟡 HIGH | Hardcoded router, MEV vulnerable |
+| **Batch Staking** | 🟡 HIGH | No access control or validation |
+| **External Exploit** | 🟡 MEDIUM | Limited attack surface for external actors |
+| **Code Quality** | 🟢 GOOD | Has reentrancy protection, safe math |
+
+---
+
+## Decompilation Limitations
+
+**Important**: This is a DECOMPILED contract, which means:
+1. Variable names are inferred and may be incorrect
+2. Some logic may be misinterpreted
+3. Compiler optimizations may obscure intent
+4. Comments and documentation are lost
+5. Some functions may have hidden behavior
+
+**Recommendation**: Obtain original source code for accurate audit.
+
+---
+
+## Comparison to Other Audited Contracts
+
+**vs. basedAIFarm** (previous audit):
+- ❌ Worse: Has `withdrawTokens(0)` rug pull (basedAIFarm had `redeemAllRewards`)
+- ❌ Worse: Malicious extension attack vector
+- ❌ Worse: Reward redistribution bug
+- ✅ Better: Has reentrancy protection
+- ✅ Better: Has lockup period (but owner can change it)
+
+**vs. PAAL AI** (previous audit):
+- ❌ Worse: More direct rug pull capability
+- ❌ Similar: Both have owner god-mode
+- ✅ Better: No hidden tax backdoor
+- ✅ Better: Simpler logic (less room for hidden traps)
+
+---
+
+## Recommendations
+
+### For Users:
+
+1. **DO NOT USE**: This contract is extremely dangerous
+2. **VERIFY OWNER**: Check if owner is renounced or multi-sig
+3. **CHECK EXTENSION**: Verify extension contract is safe (if set)
+4. **TEST UNSTAKING**: Try unstaking small amount first
+5. **MONITOR LOCKUP**: Watch for lockup period changes
+6. **AVOID COMPOUNDING**: Compound function has MEV risks
+
+### For Owner/Team (If Legitimate):
+
+1. **REMOVE `withdrawTokens()`**: This is a rug pull function
+2. **LOCK EXTENSION**: Make extension immutable after deployment
+3. **LOCK LOCKUP PERIOD**: Make lockup period immutable
+4. **FIX REWARD BUG**: Don't redistribute rewards on unstake
+5. **ADD TIMELOCK**: Implement timelock for all owner functions
+6. **MULTI-SIG**: Transfer ownership to multi-sig wallet
+7. **AUDIT EXTENSION**: Get extension contract audited
+8. **UPGRADE ROUTER**: Make Uniswap router upgradeable
+
+### Critical Code Changes Needed:
+
+```solidity
+// REMOVE THIS FUNCTION ENTIRELY:
+function withdrawTokens(uint256 amount) public nonPayable {
+    // This is a rug pull function
+}
+
+// MAKE EXTENSION IMMUTABLE:
+function setPoolExtension(address varg0) public nonPayable {
+    require(_extension == address(0), "Already set");
+    require(varg0 != address(0), "Invalid address");
+    _extension = varg0;
+}
+
+// MAKE LOCKUP IMMUTABLE:
+function setLockupPeriod(uint256 value) public nonPayable {
+    require(_lockupPeriod == 0, "Already set");
+    require(value < 0x1e13380, Error('lte 1 year'));
+    _lockupPeriod = value;
+}
+
+// FIX REWARD REDISTRIBUTION:
+// Don't call @_depositRewards_1940() in @_removeShares_1889()
+// Give rewards to user instead
+```
+
+---
+
+## On-Chain Verification Steps
+
+To verify if this contract is currently dangerous:
+
+1. **Check Owner**:
+   ```
+   Call: owner()
+   If returns: 0x0000... → Renounced (safer)
+   If returns: EOA → DANGEROUS
+   ```
+
+2. **Check Extension**:
+   ```
+   Call: extension()
+   If returns: 0x0000... → No extension (safer)
+   If returns: address → AUDIT THAT CONTRACT
+   ```
+
+3. **Check Lockup Period**:
+   ```
+   Call: lockupPeriod()
+   Returns: seconds (0 to 31,536,000)
+   ```
+
+4. **Test Unstaking**:
+   - Stake small amount
+   - Wait for lockup period
+   - Try to unstake
+   - Verify you receive tokens AND rewards
+
+---
+
+## Conclusion
+
+**VERDICT**: 🔴 **EXTREME DANGER - DO NOT USE**
+
+This contract has:
+- ❌ Owner can drain all staked tokens instantly
+- ❌ Malicious extension can manipulate everything
+- ❌ Owner can trap users by changing lockup
+- ❌ Reward redistribution bug steals user rewards
+- ❌ No timelock or multi-sig protection
+- ✅ Has reentrancy protection
+- ✅ Uses safe math
+
+**For Users**: **AVOID THIS CONTRACT** unless:
+1. Owner is renounced or multi-sig with timelock
+2. Extension contract is audited and safe
+3. Lockup period is reasonable and locked
+4. You test unstaking with small amount first
+
+**For Owner**: If this is legitimate, remove the rug pull function, lock the extension and lockup period, fix the reward redistribution bug, and implement proper security measures.
+
+**Exploitability**: Not easily exploitable by external attackers, but owner has god-mode control including instant rug pull capability.
+
+**Current Status**: Cannot determine safety without checking on-chain owner, extension, and lockup period. **ASSUME DANGEROUS UNTIL PROVEN SAFE.**
+
+---
+
+**Audit Complete** ✓
+
+**CRITICAL WARNING**: This contract allows the owner to withdraw all staked tokens at any time with no restrictions. The `withdrawTokens(0)` function is an instant rug pull mechanism.