Platform: Code4rena
Start Date: 18/10/2022
Pot Size: $75,000 USDC
Total HM: 27
Participants: 144
Period: 7 days
Judge: gzeon
Total Solo HM: 13
Id: 170
League: ETH
Rank: 102/144
Findings: 2
Award: $0.02
🌟 Selected for report: 0
🚀 Solo Findings: 0
https://github.com/code-423n4/2022-10-holograph/blob/main/contracts/enforcer/PA1D.sol#L416 https://github.com/code-423n4/2022-10-holograph/blob/main/contracts/enforcer/PA1D.sol#L439
Some ERC20 tokens functions don’t return a boolean, for example USDT, BNB, OMG. So the contract simply won’t work with tokens like that as the token.
The USDT’s transfer and transferFrom functions doesn’t return a bool, so the call to these functions will revert although the user has enough balance and the contract won’t work, assuming that token is USDT. https://github.com/code-423n4/2022-10-holograph/blob/main/contracts/enforcer/PA1D.sol#L416 https://github.com/code-423n4/2022-10-holograph/blob/main/contracts/enforcer/PA1D.sol#L439
Manual audit
Use the OpenZepplin’s safeTransfer and safeTransferFrom functions.
#0 - gzeoneth
2022-10-28T10:02:11Z
Duplicate of #456
🌟 Selected for report: oyc_109
Also found by: 0x040, 0x1f8b, 0x5rings, 0xNazgul, 0xSmartContract, 0xZaharina, 0xsam, 0xzh, 2997ms, Amithuddar, Aymen0909, B2, Bnke0x0, Deivitto, Diana, Dinesh11G, Franfran, JC, JrNet, Jujic, KingNFT, KoKo, Mathieu, Metatron, Mukund, Olivierdem, PaludoX0, Pheonix, Picodes, RaymondFam, RedOneN, ReyAdmirado, Rolezn, Saintcode_, Satyam_Sharma, Shinchan, Tagir2003, Tomio, Waze, Yiko, __141345__, adriro, ajtra, aysha, ballx, beardofginger, bobirichman, brgltd, bulej93, catchup, catwhiskeys, cdahlheimer, ch0bu, chaduke, chrisdior4, cryptostellar5, cylzxje, d3e4, delfin454000, dharma09, djxploit, durianSausage, emrekocak, erictee, exolorkistis, fatherOfBlocks, gianganhnguyen, gogo, halden, hxzy, i_got_hacked, iepathos, karanctf, leosathya, lucacez, lukris02, lyncurion, m_Rassska, martin, mcwildy, mics, nicobevi, peanuts, peiw, rbserver, ret2basic, rotcivegaf, ryshaw, sakman, sakshamguruji, saneryee, sikorico, skyle, svskaushik, tnevler, vv7, w0Lfrum, zishansami
0 USDC - $0.00
| Issue | Instances | |
|---|---|---|
| 1 | Change i++ to ++i | 5 |
i++ to ++ifor (uint i = 0; i < length; i++) {
https://github.com/code-423n4/2022-10-holograph/blob/main/src/HolographOperator.sol#L682 https://github.com/code-423n4/2022-10-holograph/blob/main/src/HolographOperator.sol#L772 https://github.com/code-423n4/2022-10-holograph/blob/main/src/enforcer/HolographERC721.sol#L258 https://github.com/code-423n4/2022-10-holograph/blob/main/src/enforcer/HolographERC721.sol#L617 https://github.com/code-423n4/2022-10-holograph/blob/main/src/enforcer/HolographERC20.sol#L465