prePO contest - Kenshin's results

Gain exposure to pre-IPO companies & pre-token projects.

General Information

Platform: Code4rena

Start Date: 17/03/2022

Pot Size: $30,000 USDC

Total HM: 8

Participants: 43

Period: 3 days

Judge: gzeon

Total Solo HM: 5

Id: 100

League: ETH

prePO

Findings Distribution

Researcher Performance

Rank: 29/43

Findings: 2

Award: $79.47

🌟 Selected for report: 0

πŸš€ Solo Findings: 0

Awards

50.8486 USDC - $50.85

Labels

bug
QA (Quality Assurance)
disagree with severity

External Links

Minting Fee and Redemption Fee Can Be Set To Zero

Description

I noticed that only FEE_LIMIT exceeding check was applied to these fees' setter function. For instance, _mintingFee is used in multiplication, by setting its fee to zero will result in multiply by zero.

  1. https://github.com/code-423n4/2022-03-prepo/blob/f63584133a0329781609e3f14c3004c1ca293e71/contracts/core/PrePOMarket.sol#L197
  2. https://github.com/code-423n4/2022-03-prepo/blob/f63584133a0329781609e3f14c3004c1ca293e71/contracts/core/PrePOMarket.sol#L207

Mitigation

It is recommended to make a clarification whether any fee can be zero or not and in which circumstance(s)/condition(s). If it shouldn't, then a zero-value validation should be implemented to these fee's setter function.

#0 - ramenforbreakfast

2022-03-22T22:25:49Z

Not an issue, fees can be zero. I believe this is a documentation issue for expectations regarding fees. Marking this as disagree with severity.

Awards

28.6158 USDC - $28.62

Labels

bug
G (Gas Optimization)

External Links

Unmodified Memory Variables

Description

Unmodified memory variable were found. If the variables are intended to be read-only, then calldata can be used instead to ensure that the variables are immutable and also cost less gas.

  1. https://github.com/code-423n4/2022-03-prepo/blob/f63584133a0329781609e3f14c3004c1ca293e71/contracts/core/PrePOMarketFactory.sol#L42 (_tokenNameSuffix and _tokenSymbolSuffix)
  2. https://github.com/code-423n4/2022-03-prepo/blob/f63584133a0329781609e3f14c3004c1ca293e71/contracts/core/PrePOMarketFactory.sol#L93 (_tokenNameSuffix and _tokenSymbolSuffix)

Mitigation

Those read-only variables should be marked as calldata instead which can save more gas.

#0 - ramenforbreakfast

2022-03-22T22:23:11Z

duplicate of #5

AuditHub

A portfolio for auditors, a security profile for protocols, a hub for web3 security.

Built bymalatrax Β© 2024

Auditors

Browse

Contests

Browse

Get in touch

ContactTwitter