CODEUP audit

A private security review of Codeup (DeFi game), conducted with Three Sigma and completed on 23rd October 2024 over 5 days. 0xSimao disclosed 12 findings: 4 high severity, 1 medium, 2 low and 5 informational.

What Codeup is

CODEUP is an on-chain game: players build towers floor by floor, hiring builders that generate in-game ETH ('gameETH'), and accumulating forty builders mints CUP, an ERC-20 reward token with a Uniswap market created by the game itself.

Scope

The contract custodies real ETH, so the review treated it as a vault with rules: the ETH/WETH accounting behind gameETH, pro-rata tower withdrawals, precision in the game's own rounding, and the CUP/Uniswap creation path.

High severity findings

• Total ETH, WETH and gameETH are not tracked which will lead to insolvency
• Significant rounding errors due to gameETH not having precision
• tower.gameETHForWithdraw should be reduced pro-rata when there is not enough ETH
• Codeup::claimCodeupERC20() may be forever DoSed by creating the Uniswap pool before it is called

Medium severity findings

• Codeup::claimCodeupERC20() may revert whenever the weth balance is very low

Low severity findings

• Missing key zero value check
• Codeup::claimCodeupERC20() is vulnerable to sandwich attacks

Informational findings

• Typos in the codebase
• Hardcoded values present in the codebase
• All functions could have a started modifier as they should not be called before the start time
• Ownable is unused in CodeupERC20 and could be removed
• Unused TransferFailed error in CodeupERC20

The report

Download report (PDF)