CodeUp

Introduction

Code UP is a tower-building strategy game fused with DeFi mechanics.

Players deposit gameETH to hire “builders.” Every 40 builders mints one CUP ERC-20 reward. While towers accrue yield over time, the protocol automatically swaps surplus WETH for CUP and seeds Uniswap V2 liquidity so the token has instant market depth.

Why Did They Need an Audit?

The game juggles multiple cash-flows (player deposits, yield payouts, trading commissions, LP seeding) and relies on precise accounting to remain solvent. An error in pool-creation sequencing, share math, or rounding could let attackers lock the protocol or bleed its ETH reserves. Code UP engaged Three Sigma for a one-week deep audit ahead of launch on Arbitrum, Ethereum, Optimism, Base, and Polygon.

Scope of the Engagement

• Team: 2 auditors - 1 person-week
• Chain: Arbitrum, Ethereum, Optimism, Base, Polygon

Results and Findings

Key Critical Issues

Pre-emptive Uniswap pool DoS

• Description: Anyone could create the CUP/WETH pair before claimCodeupERC20() ran, causing the function to revert forever and blocking liquidity deployment.
• Resolution: the contract now skips createPair() entirely and instead queries getPair() after addLiquidity, ensuring the address is set whether or not the pool existed beforehand.

Lossy ETH payouts on partial balance

• Description: withdraw() and reinvest() zeroed each tower’s gameETHForWithdraw even when the contract lacked enough ETH to satisfy all claims, letting early callers drain the pot and erasing later players’ balances.
• Resolution: the variable is now reduced pro-rata to the actual ETH sent, safeguarding residual credit for subsequent withdrawals.

Protocol insolvency through untracked totals

• Description: Neither total ETH nor total issued gameETH were tracked; with compound upgrades a player could withdraw more ETH than deposited after ~16 hours, inevitably bankrupting the pool once new deposits slowed.
• Resolution: added global supply counters, capped gameETH purchase to remaining upgrade cost, and redirected leftover WETH fees into locked liquidity.

Notable High-Severity Issues

Rounding-error fee leakage

• Description: Because gameETH = amount / price used integer division with zero decimals, users lost up to 1e-12 ETH per purchase—insignificant individually but material at scale.
• Resolution: Introduced 18-dec precision by scaling upgrade prices and yields and lowering gameETHPrice.

In conclusion

Three Sigma’s audit surfaced three critical design flaws that could have halted pool creation, erased player balances, or bankrupted the protocol. After implementing the recommended fixes—robust pair detection, proportional withdrawal logic, precise supply accounting, and high-precision math—Code UP can safely reward tower builders and sustain its in-game economy across multiple chains.