Shell Protocol - JP_Courses's results

A set of EVM-based smart contracts on Arbitrum One. In a nutshell it is DeFi made simple.

General Information

Platform: Code4rena

Start Date: 21/08/2023

Pot Size: $36,500 USDC

Total HM: 1

Participants: 43

Period: 7 days

Judge: Dravee

Id: 277

League: ETH

Shell Protocol

Findings Distribution

Researcher Performance

Rank: 23/43

Findings: 2

Award: $31.62

QA:
grade-b
Gas:
grade-b

🌟 Selected for report: 0

🚀 Solo Findings: 0

Awards

9.1555 USDC - $9.16

Labels

bug
grade-b
low quality report
QA (Quality Assurance)
edited-by-warden
Q-01

External Links

  1. QA: The dev comment needs some clarity added, as per below.

https://github.com/code-423n4/2023-08-shell/blob/8ed551004f470489e070c1dd617d67eb4bf114e6/src/proteus/EvolvingProteus.sol#L38

The following should be added to the current comment on L38:

"...will result in transaction failure if the transaction amount is too small relative to the size of the reserves in the pool."

  1. QA: The following should be added to the dev comment for clarity and completion, to eliminate any chance of misunderstandings/confusion:

https://github.com/code-423n4/2023-08-shell/blob/8ed551004f470489e070c1dd617d67eb4bf114e6/src/proteus/EvolvingProteus.sol#L39

L39: "A transaction amount either as an input into the pool or an output from the pool will result in a transaction failure if the transaction amount is too large relative to the size of the reserves in the pool."

  1. QA: The dev comment is partially correct, and the correction is below:

https://github.com/code-423n4/2023-08-shell/blob/8ed551004f470489e070c1dd617d67eb4bf114e6/src/proteus/EvolvingProteus.sol#L40

L40: Replace the existing relevant part with this, because there's no above for this scenario/case: "...in the pool going below this ratio will fail."

  1. QA: Incorrect dev comment.

https://github.com/code-423n4/2023-08-shell/blob/8ed551004f470489e070c1dd617d67eb4bf114e6/src/proteus/EvolvingProteus.sol#L120

Comment is incorrect, should be: "the sq. root of x instantaneous price", as this is not inverse like for a.

  1. QA: Incorrect dev comment.

https://github.com/code-423n4/2023-08-shell/blob/8ed551004f470489e070c1dd617d67eb4bf114e6/src/proteus/EvolvingProteus.sol#L240

corrected comment is: "px_final The final price at the x axis"

  1. LOW: Input validation: no checks for whether px_init == px_final, and same for py...checks

https://github.com/code-423n4/2023-08-shell/blob/8ed551004f470489e070c1dd617d67eb4bf114e6/src/proteus/EvolvingProteus.sol#L249

  1. LOW: if comment below is correct: "greater than the MIN_BALANCE", then this if statement should be corrected to include = as follows: (x <= MIN_BALANCE || y <= MIN_BALANCE). However, if this line is correct as is, then the comment above needs to be changed to "greater than or equal to the MIN_BALANCE"

Comment: /** * @dev The pool's balances of the x reserve and y reserve tokens must be * greater than the MIN_BALANCE * @dev The pool's ratio of y to x must be within the interval * [MIN_M, MAX_M) */

https://github.com/code-423n4/2023-08-shell/blob/8ed551004f470489e070c1dd617d67eb4bf114e6/src/proteus/EvolvingProteus.sol#L810

#0 - 0xRobocop

2023-08-30T01:06:11Z

  1. Invalid

px_init == px_final is possible, it means that the curve will not mutate.

  1. Depending on the final severity, it may be dup of #131

#1 - c4-pre-sort

2023-08-30T01:06:51Z

0xRobocop marked the issue as low quality report

#2 - c4-judge

2023-09-11T19:30:43Z

JustDravee marked the issue as grade-b

Findings Information

Labels

bug
G (Gas Optimization)
grade-b
sufficient quality report
G-01

Awards

22.4575 USDC - $22.46

External Links

  1. Add an unchecked block unchecked {} because this can never underflow/overflow.

https://github.com/code-423n4/2023-08-shell/blob/8ed551004f470489e070c1dd617d67eb4bf114e6/src/proteus/EvolvingProteus.sol#L82

function elapsed(Config storage self) public view returns (uint256) { unchecked { return block.timestamp - self.t_init; } }

#0 - c4-pre-sort

2023-08-30T03:37:46Z

0xRobocop marked the issue as sufficient quality report

#1 - c4-judge

2023-09-11T20:01:46Z

JustDravee marked the issue as grade-b

AuditHub

A portfolio for auditors, a security profile for protocols, a hub for web3 security.

Built bymalatrax © 2024

Auditors

Browse

Contests

Browse

Get in touch

ContactTwitter