Canto contest - 0xmint's results

Execution layer for original work.

General Information

Platform: Code4rena

Start Date: 14/06/2022

Pot Size: $100,000 USDC

Total HM: 26

Participants: 59

Period: 7 days

Judge: GalloDaSballo

Total Solo HM: 9

Id: 133

League: ETH

Canto

Findings Distribution

Researcher Performance

Rank: 26/59

Findings: 4

Award: $782.50

🌟 Selected for report: 0

🚀 Solo Findings: 0

Findings Information

🌟 Selected for report: Ruhum

Also found by: 0xmint, cccz, csanuragjain, dipp, hake, zzzitron

Labels

bug
duplicate
3 (High Risk)

Awards

1532.982 CANTO - $247.58

247.5766 USDC - $247.58

External Links

Lines of code

https://github.com/Plex-Engineer/lending-market/blob/755424c1f9ab3f9f0408443e6606f94e4f08a990/contracts/Governance/GovernorBravoDelegate.sol#L63

Vulnerability details

https://github.com/Plex-Engineer/lending-market/blob/755424c1f9ab3f9f0408443e6606f94e4f08a990/contracts/Governance/GovernorBravoDelegate.sol#L63

All the relevant fields for a proposal is set in queue () but executed is marked as true, even before the proposal is even queued. When it comes time to execute a proposal, this will be impossible since state () will always return ProposalState.Executed.

The condition below will never return true

https://github.com/Plex-Engineer/lending-market/blob/755424c1f9ab3f9f0408443e6606f94e4f08a990/contracts/Governance/GovernorBravoDelegate.sol#L87

newProposal.executed should be the default value (false) as it is set after the condition is checked in state() :

https://github.com/Plex-Engineer/lending-market/blob/755424c1f9ab3f9f0408443e6606f94e4f08a990/contracts/Governance/GovernorBravoDelegate.sol#L89

#0 - nivasan1

2022-06-24T03:21:08Z

duplicate of #39

Awards

72.4555 USDC - $72.46

687.9945 CANTO - $111.11

Labels

bug
QA (Quality Assurance)

External Links

Modify comments

‘@notice Returns the WETH address

@return the WETH address’

https://github.com/Plex-Engineer/lending-market/blob/755424c1f9ab3f9f0408443e6606f94e4f08a990/contracts/Comptroller.sol#L1466-L1467

NatSpec @param missing

@param treasury_:

https://github.com/Plex-Engineer/lending-market/blob/755424c1f9ab3f9f0408443e6606f94e4f08a990/contracts/Accountant/AccountantDelegate.sol#L15

@param borrower

https://github.com/Plex-Engineer/lending-market/blob/755424c1f9ab3f9f0408443e6606f94e4f08a990/contracts/CNote.sol#L31

Grammatical Errors

‘paid’

https://github.com/Plex-Engineer/lending-market/blob/755424c1f9ab3f9f0408443e6606f94e4f08a990/contracts/CNote.sol#L92

‘underlying’

https://github.com/Plex-Engineer/lending-market/blob/755424c1f9ab3f9f0408443e6606f94e4f08a990/contracts/CNote.sol#L93

‘it's’

https://github.com/Plex-Engineer/stableswap/blob/489d010eb99a0885139b2d5ed5a2d826838cc5f9/contracts/BaseV1-core.sol#L480

Use assignment operator for better readability

Use - = :

https://github.com/Plex-Engineer/lending-market/blob/755424c1f9ab3f9f0408443e6606f94e4f08a990/contracts/CNote.sol#L335-L336

+=:

https://github.com/Plex-Engineer/lending-market/blob/755424c1f9ab3f9f0408443e6606f94e4f08a990/contracts/CNote.sol#L243-L244

Variables are already default type

isPaused is already implicitly false,no need to set it in the constructor since setPause() exists :

https://github.com/Plex-Engineer/stableswap/blob/489d010eb99a0885139b2d5ed5a2d826838cc5f9/contracts/BaseV1-core.sol#L490

Already zero, no need to initialise.

https://github.com/Plex-Engineer/stableswap/blob/489d010eb99a0885139b2d5ed5a2d826838cc5f9/contracts/BaseV1-core.sol#L46

https://github.com/Plex-Engineer/stableswap/blob/489d010eb99a0885139b2d5ed5a2d826838cc5f9/contracts/BaseV1-core.sol#L223-L224

#0 - GalloDaSballo

2022-08-01T23:16:11Z

@notice Returns the WETH address

Valid NC

Natspec

NC

Grammar

NC

Use assignment operator for better readability

Disagree as convention is to use those only in assembly

## Variables are already default type

Valid Ref

Overall could have been formatted better, and I think there are tons more things the warden could have found

#1 - GalloDaSballo

2022-08-01T23:16:18Z

1 R 3 NC

AuditHub

A portfolio for auditors, a security profile for protocols, a hub for web3 security.

Built bymalatrax © 2024

Auditors

Browse

Contests

Browse

Get in touch

ContactTwitter