Assessment reportsPublic findings
Back to Zellic siteBack
↗
Assessment reports>Concrete>Informational findings>ConcreteMultiStrategy should inherit from ReentrancyGuardUpgradeable instead of ReentrancyGuard
GeneralOverview
Findings
High (2)
Medium (6)
Low (8)
Informational (9)The fees charged to the feeRecipient are inconsistent between functions deposit and mintThe BTCLinkedPriceFeed contract does not initialize the ownerInsufficient validation of _requestIdUnchecked return value in setParkingLotIncorrect withdrawable check in _withdrawStrategyFundsConcreteMultiStrategy should inherit from ReentrancyGuardUpgradeable instead of ReentrancyGuardIncorrect implementation of max functions in ConcreteMultiStrategyStrategy rewards accrue after the share price has been calculatedIncorrect use of the function _getRewardTokens to initialize the rewardTokens
DiscussionThe ConcreteOracle.getAssetPrice should ensure the returned price uses eight decimalsUnused _decimals variable in strategiesTest suite
DesignComponent: ControllerComponent: ConcreteMultiStrategyVaultComponent: WithdrawalComponent: Strategies
Audit ResultsAssessment Results
Category: Coding Mistakes

ConcreteMultiStrategy should inherit from ReentrancyGuardUpgradeable instead of ReentrancyGuard

Informational Impact
Informational Severity
N/A Likelihood

Description

The ConcreteMultiStrategy contract deploys via clone, and its state initializes in the initialize function. Therefore, it should inherit from ReentrancyGuardUpgradeable instead of ReentrancyGuard.

Impact

The _status storage variable in ConcreteMultiStrategy remains uninitialized during the initialize call. Although it will be correctly set to NOT_ENTERED after the first invocation of the nonReentrant modifier, it is best practice to inherit from ReentrancyGuardUpgradeable.

Recommendations

ConcreteMultiStrategy should inherit ReentrancyGuardUpgradeable instead of ReentrancyGuard and initialize the _status storage variable in the initialize function.

Remediation

This issue has been acknowledged by Blueprint Finance, and a fix was implemented in commit 0884cb28↗.

Zellic © 2025Back to top ↑