Platform: Code4rena
Start Date: 17/03/2022
Pot Size: $30,000 USDC
Total HM: 8
Participants: 43
Period: 3 days
Judge: gzeon
Total Solo HM: 5
Id: 100
League: ETH
Rank: 20/43
Findings: 2
Award: $97.23
🌟 Selected for report: 0
🚀 Solo Findings: 0
🌟 Selected for report: defsec
Also found by: 0x1f8b, 0xDjango, 0xNazgul, 0xkatana, 0xwags, CertoraInc, Funen, GeekyLumberjack, GreyArt, IllIllI, Kenshin, Ruhum, TerrierLover, WatchPug, berndartmueller, bugwriter001, cccz, cmichel, csanuragjain, hake, kenta, kirk-baird, leastwood, minhquanym, oyc_109, peritoflores, rayn, remora, rfa, robee, saian, samruna, sorrynotsorry, wuwe1
60.1124 USDC - $60.11
amount exceed the total allowed to withdraw, instead of fault the transaction it set the amount to 0.clearAllowedAccounts should force to change the _root, otherwise the users can use allowSelf to be allowed again.approve, transfer and transferFrom calls. ERC20 standard specify that the token can return false if the transfer was not made, so it's mandatory to check the result of this calls._deployedMarkets[_salt] already exists, so a possible collision could occur and change the stored market entry.false or 0)#0 - ramenforbreakfast
2022-03-22T22:20:02Z
1 and 2 are too vague for me to consider as valid submissions.
3 needs to demonstrate how such a situation would occur.
4 is not an issue, this is why we have setRootAndClearAllowedAccounts to perform this atomically.
5 is a duplicate of #4.
6 is a duplicate of #2.
7 is a minor change and does not explain the benefits of doing this.
37.1175 USDC - $37.12
immutable keyword for the following variables:None, Allowed, Blocked, Allowed And Blocked it's possible to save storage slots, and storage calls for checking if the account is allowed but not blocked, like here.delete instead of store the entries in another index can save a lot of storage access.i++ to ++i in order to save some opcodes:== true or == false, instead of using the boolean value, or NOT opcode, it's cheaper to use NOT when the value it's false, or just the value without == true, when it's true, because it will use less opcode inside the VM.#0 - ramenforbreakfast
2022-03-22T22:14:03Z
1,4,6 are duplicates of #5 2 and 3 are suggestions that would add additional complexity and have its own trade-offs. I consider these invalid. 5 is a nit that is valid, but I will mark this issue as a duplicate.