Nouns Builder contest - Jujic's results

A permissionless, governed protocol to deploy nouns-style DAOs complete with treasury, generative collections, and governance mechanisms.

General Information

Platform: Code4rena

Start Date: 06/09/2022

Pot Size: $90,000 USDC

Total HM: 33

Participants: 168

Period: 9 days

Judge: GalloDaSballo

Total Solo HM: 10

Id: 157

League: ETH

Nouns Builder

Findings Distribution

Researcher Performance

Rank: 114/168

Findings: 1

Award: $60.77

🌟 Selected for report: 0

🚀 Solo Findings: 0

Lines of code

https://github.com/code-423n4/2022-09-nouns-builder/blob/7e9fddbbacdd7d7812e912a369cfd862ee67dc03/src/token/Token.sol#L43

Vulnerability details

Impact

Most contracts use initialize() functions instead of constructor given the delegatecall proxy pattern. While most of them emit an event in the critical initialize() functions to record the init parameters for off-chain monitoring and transparency reasons.

Impact: The Token contract is initialized but their critical init parameters (name, symbol and etc.) are not logged for any off-chain monitoring.

Proof of Concept

Provide direct links to all referenced code in GitHub. Add screenshots, logs, or any other relevant proof that illustrates the concept.

Tools Used

https://github.com/code-423n4/2021-06-pooltogether-findings/issues/68

Emit an initialised event in Token.sol logging their init parameters.

#0 - GalloDaSballo

2022-09-17T20:56:59Z

Valid NC, Leighton FUD Defense Squad

I'm gonna vindicate that judging to say that a even should always be marked as NC, unless the event is used for bridging which is not the case here

<img width="969" alt="Screenshot 2022-09-17 at 22 56 19" src="https://user-images.githubusercontent.com/13383782/190876133-51e8b9ea-bfcf-43d4-9386-36beb4c69ec8.png">

#1 - GalloDaSballo

2022-09-28T23:03:32Z

NC

AuditHub

A portfolio for auditors, a security profile for protocols, a hub for web3 security.

Built bymalatrax © 2024

Auditors

Browse

Contests

Browse

Get in touch

ContactTwitter