Platform: Code4rena
Start Date: 10/05/2022
Pot Size: $50,000 USDC
Total HM: 13
Participants: 100
Period: 5 days
Judge: HardlyDifficult
Total Solo HM: 1
Id: 122
League: ETH
Rank: 95/100
Findings: 2
Award: $19.06
🌟 Selected for report: 0
🚀 Solo Findings: 0
🌟 Selected for report: IllIllI
Also found by: 0x52, 0xf15ers, 0xsanson, Bludya, BondiPestControl, Czar102, GimelSec, Kumpa, _Adam, berndartmueller, catchup, crispymangoes, eccentricexit, ellahi, hake, horsefacts, pedroais, peritoflores, reassor, shenwilly, shung, smiling_heretic, sseefried, throttle
8.1655 USDC - $8.17
Option seller receives less than desired minimum
Admins can update the protocol fees by calling setfee(). The seller will receive the agreed strike price less the protocol fee. If the fee is changed after the option is sold then seller will receive less than expected
Add a fee parameter to the vault struct and cache the current fee when the vault is created. When calculating fee on exercise, use that calculate fee
#0 - outdoteth
2022-05-15T19:03:44Z
owner can change fee at any time; https://github.com/code-423n4/2022-05-cally-findings/issues/47
🌟 Selected for report: 0x1337
Also found by: 0x52, 0xDjango, 0xsanson, BondiPestControl, BowTiedWardens, GimelSec, IllIllI, MaratCerby, MiloTruck, PPrieditis, TrungOre, VAD37, WatchPug, berndartmueller, cccz, dipp, hake, hickuphh3, horsefacts, hubble, minhquanym, reassor, shenwilly, smiling_heretic
10.8874 USDC - $10.89
Loss of user funds in contract
In L174 the vault sets the quantity of ERC20 it has to the amount specified on input. However for fee on transfer tokens, the actual amount received would be short the fee taken on transfer. This would completely lock up the vault, breaking both the exercise and withdraw function because the transfer at the end would always fail due to insufficient token balance
Record the balance of the contract before and after receiving the transfer to determine the number of ERC20 tokens actually received
#0 - outdoteth
2022-05-15T17:13:27Z
reference issue: https://github.com/code-423n4/2022-05-cally-findings/issues/39