Rubicon contest - AlleyCat's results

An order book protocol for Ethereum, built on L2s.

General Information

Platform: Code4rena

Start Date: 23/05/2022

Pot Size: $50,000 USDC

Total HM: 44

Participants: 99

Period: 5 days

Judge: hickuphh3

Total Solo HM: 11

Id: 129

League: ETH

Rubicon

Findings Distribution

Researcher Performance

Rank: 77/99

Findings: 2

Award: $68.24

🌟 Selected for report: 0

🚀 Solo Findings: 0

Findings Information

Labels

bug
duplicate
2 (Med Risk)
upgraded by judge

Awards

16.2035 USDC - $16.20

External Links

Judge has assessed an item in Issue #20 as Medium risk. The relevant finding follows:

#0 - HickupHH3

2022-06-16T04:53:48Z

  1. Excess ETH sent with payable function call is not returned to caller In RubiconRouter when calling functions buyAllAmountWithETH, offerWithETH, depositWithETH and swapWithETH if the value of ETH sent along the call is higher than the specific amount set in the parameters, then the excess is not sent back to the caller and gets stuck in the contract. Consider one of the two proposed mitigations

Change the check on minimum call value to a check to exact call value: require(msg.value == max_fill_withFee) Tranfer the excess ETH back to the caller at the end of the function. For example for buyAllAmountWithETH this would be msg.sender.transfer(msg.value - max_fill_withFee)

#1 - HickupHH3

2022-06-16T04:54:01Z

Duplicate of #15

State Variable Visibility Not Set

Fix

It is best practice to explicitly set the visibility to one of internal, public, or private for state variables.

AuditHub

A portfolio for auditors, a security profile for protocols, a hub for web3 security.

Built bymalatrax © 2024

Auditors

Browse

Contests

Browse

Get in touch

ContactTwitter