Platform: Code4rena
Start Date: 12/08/2022
Pot Size: $35,000 USDC
Total HM: 10
Participants: 126
Period: 3 days
Judge: Justin Goro
Total Solo HM: 3
Id: 154
League: ETH
Rank: 92/126
Findings: 1
Award: $30.34
🌟 Selected for report: 0
🚀 Solo Findings: 0
🌟 Selected for report: oyc_109
Also found by: 0x1f8b, 0x52, 0xDjango, 0xLovesleep, 0xNazgul, 0xNineDec, 0xbepresent, 0xmatt, 0xsolstars, Aymen0909, Bahurum, Bnke0x0, CertoraInc, Chom, CodingNameKiki, DecorativePineapple, Deivitto, Dravee, ElKu, Funen, GalloDaSballo, IllIllI, JC, JohnSmith, Junnon, KIntern_NA, Lambda, LeoS, MiloTruck, Noah3o6, PaludoX0, RedOneN, Respx, ReyAdmirado, Rohan16, RoiEvenHaim, Rolezn, Ruhum, Sm4rty, TomJ, Vexjon, Waze, Yiko, __141345__, a12jmx, ajtra, ak1, apostle0x01, asutorufos, auditor0517, bin2chen, bobirichman, brgltd, bulej93, byndooa, c3phas, cRat1st0s, cryptphi, csanuragjain, d3e4, defsec, delfin454000, djxploit, durianSausage, ellahi, erictee, exd0tpy, fatherOfBlocks, gogo, jonatascm, ladboy233, medikko, mics, natzuu, neumo, p_crypt0, paribus, pfapostol, rbserver, reassor, ret2basic, robee, rokinot, rvierdiiev, sach1r0, saneryee, seyni, sikorico, simon135, sseefried, wagmi, wastewa
30.3441 USDC - $30.34
In function transferOwnership
owner
is changed in a single step. Consider using a two step procedure to avoid the risk of losing contract ownership.
unlock()
function not explicitly statedWhile the team confirmed that the unlock()
function is intended to be used for migration, so it won't cause any issues, it would be better to state explicitly in natspec comment that it will break the escrow functionality and must only be used for migration.
decimals
:
State variable decimals
is assigned in the constructor (L115).VotingEscrow.sol#L257-L259
is redundant since userPointHistory[_addr][uEpoch + 1]
is always assigned afterwards at line 264.VotigEscrow.sol#L45-L66
public state variables lack naspec comment.updateBlocklist
@param _addr
is missingupdatePenaltyRecipient
@param _addr
is missingforceUndelegate
@param _addr
is missingblock
In Blocklist.sol#L23
function block()
shadows solidity built in special variable block
.