# CODEUP audit Three Sigma · DeFi game · 23rd October 2024 A private security review of Codeup (DeFi game), conducted with Three Sigma and completed on 23rd October 2024 over 5 days. 0xSimao disclosed 12 findings: 4 high severity, 1 medium, 2 low and 5 informational. ## What Codeup is CODEUP is an on-chain game: players build towers floor by floor, hiring builders that generate in-game ETH ('gameETH'), and accumulating forty builders mints CUP, an ERC-20 reward token with a Uniswap market created by the game itself. ## Scope The contract custodies real ETH, so the review treated it as a vault with rules: the ETH/WETH accounting behind gameETH, pro-rata tower withdrawals, precision in the game's own rounding, and the CUP/Uniswap creation path. ## High severity findings - [Total `ETH`, `WETH` and `gameETH` are not tracked which will lead to insolvency](https://0xsimao.com/findings/codeup-eth-weth-tracked-insolvency) - [Significant rounding errors due to `gameETH` not having precision](https://0xsimao.com/findings/codeup-rounding-game-eth-precision) - [`tower.gameETHForWithdraw` should be reduced pro-rata when there is not enough `ETH`](https://0xsimao.com/findings/codeup-tower-eth-withdraw-rata) - [`Codeup::claimCodeupERC20()` may be forever DoSed by creating the `Uniswap` pool before it is called](https://0xsimao.com/findings/codeup-erc20-forever-creating-uniswap) ## Medium severity findings - [`Codeup::claimCodeupERC20()` may revert whenever the `weth` balance is very low](https://0xsimao.com/findings/codeup-erc20-revert-weth-low) ## Low severity findings - [Missing key zero value check](https://0xsimao.com/findings/codeup-missing-key-zero-value) - [`Codeup::claimCodeupERC20()` is vulnerable to sandwich attacks](https://0xsimao.com/findings/codeup-codeup-erc20-sandwich-attacks) ## Informational findings - [Typos in the codebase](https://0xsimao.com/findings/codeup-typos-codebase) - [Hardcoded values present in the codebase](https://0xsimao.com/findings/codeup-hardcoded-values-present-codebase) - [All functions could have a `started` modifier as they should not be called before the start time](https://0xsimao.com/findings/codeup-started-modifier-called-time) - [`Ownable` is unused in `CodeupERC20` and could be removed](https://0xsimao.com/findings/codeup-ownable-codeup-erc20-removed) - [Unused `TransferFailed` error in `CodeupERC20`](https://0xsimao.com/findings/codeup-transfer-failed-codeup-erc20) ## The report [Download the report (PDF)](https://0xsimao.com/reports/2024-10-23-codeup.pdf)