Nouns Builder contest - DimitarDimitrov's results

A permissionless, governed protocol to deploy nouns-style DAOs complete with treasury, generative collections, and governance mechanisms.

General Information

Platform: Code4rena

Start Date: 06/09/2022

Pot Size: $90,000 USDC

Total HM: 33

Participants: 168

Period: 9 days

Judge: GalloDaSballo

Total Solo HM: 10

Id: 157

League: ETH

Nouns Builder

Findings Distribution

Researcher Performance

Rank: 127/168

Findings: 1

Award: $60.77

🌟 Selected for report: 0

🚀 Solo Findings: 0

Lines of code

https://github.com/code-423n4/2022-09-nouns-builder/blob/7e9fddbbacdd7d7812e912a369cfd862ee67dc03/src/manager/Manager.sol#L80-L86

Vulnerability details

Impact

Now contract receive address of owner as parameter. This can be dangerous if user set by mistake another access. The good practice is to add claimOwner (for example). This method must have check if the msg.sender is equal to owner. Then sent the owner to msg.sender. After that contract is start it job.

Proof of Concept

https://github.com/code-423n4/2022-09-nouns-builder/blob/7e9fddbbacdd7d7812e912a369cfd862ee67dc03/src/manager/Manager.sol#L80-L86

Tools Used

Code anytics

The good practice is to add claimOwner (for example). This method must have check if the msg.sender is equal to owner. Then sent the owner to msg.sender. After that contract is start it job.

#0 - GalloDaSballo

2022-09-19T21:03:56Z

2 step owner transfer is NC historically

#1 - GalloDaSballo

2022-09-19T21:04:05Z

NC

AuditHub

A portfolio for auditors, a security profile for protocols, a hub for web3 security.

Built bymalatrax © 2024

Auditors

Browse

Contests

Browse

Get in touch

ContactTwitter