Platform: Code4rena
Start Date: 10/06/2021
Pot Size: $45,000 USDC
Total HM: 21
Participants: 12
Period: 7 days
Judge: LSDan
Total Solo HM: 13
Id: 13
League: ETH
Rank: 10/12
Findings: 3
Award: $395.58
🌟 Selected for report: 1
🚀 Solo Findings: 0
JMukesh
It is usually good to add a require-statement that checks the return value or to use something like safeTransfer; unless one is sure the given token reverts in case of a failure
In RcTreasury.sol
https://github.com/code-423n4/2021-06-realitycards/blob/main/contracts/RCTreasury.sol#L298
https://github.com/code-423n4/2021-06-realitycards/blob/main/contracts/RCTreasury.sol#L350
manual review
Consider adding a require-statement or using safeTransfer()
#0 - Splidge
2021-06-15T14:52:39Z
Duplicate of #2
#1 - dmvt
2021-07-11T12:37:48Z
duplicate of #2
79.1061 USDC - $79.11
JMukesh
assert() is used for internal error checking and require() is used to check on input condition, but here assert() is used for input checking
https://github.com/code-423n4/2021-06-realitycards/blob/main/contracts/RCMarket.sol#L202
manual review
use require
#0 - Splidge
2021-06-16T09:49:50Z
This could be considered a duplicate of #44
#1 - Splidge
2021-06-17T11:30:59Z
Duplicate of #155
#2 - dmvt
2021-07-11T10:26:02Z
duplicate of #83
🌟 Selected for report: JMukesh
Also found by: 0xRajeev, a_delamo, cmichel, maplesyrup
56.9564 USDC - $56.96
JMukesh
constructor of RCorderbook.sol lacks zero address validation , since parameter of costructor are used initialize state variable which are used in other function of the contract , error in these state variable can lead to redeployment of contract
https://github.com/code-423n4/2021-06-realitycards/blob/main/contracts/RCOrderbook.sol#L106
manual review
add require condition to check for zero address
#0 - Splidge
2021-06-16T08:01:13Z
I think the zero address validation isn't a problem for factoryAddress as this can be set later in the function setFactoryAddress
However yes Treasury is missing a possible setTreasuryAddress
#1 - Splidge
2021-06-21T10:18:25Z
implemented here
#2 - Splidge
2021-06-21T10:41:14Z
Additional changes for #142 and #115 are here
JMukesh
address public _realitioAddress, this state variable was unused throughout the contract in RCmarket.sol
https://github.com/code-423n4/2021-06-realitycards/blob/main/contracts/RCMarket.sol#L122
manual review
remove the state variable which are unused
#0 - Splidge
2021-06-16T07:57:00Z
Duplicate of #7