Backed Protocol contest - Kenshin's results

Protocol for peer to peer NFT-Backed Loans.

General Information

Platform: Code4rena

Start Date: 05/04/2022

Pot Size: $30,000 USDC

Total HM: 10

Participants: 47

Period: 3 days

Judge: gzeon

Total Solo HM: 4

Id: 106

League: ETH

Backed Protocol

Findings Distribution

Researcher Performance

Rank: 33/47

Findings: 2

Award: $84.80

🌟 Selected for report: 0

🚀 Solo Findings: 0

Awards

51.8678 USDC - $51.87

Labels

bug
QA (Quality Assurance)
sponsor acknowledged

External Links

Interface or Contract Type Should Be Used

Description

When passing a contract address as an argument to a function, it is recommended to use the interface or contract type rather than the address type. Explicitly defining as an interface or contract type can provide additional type safety guarantees; for example, the compiler can catch any unrecognized or undeclared function called to that contract address within the function. More: https://consensys.github.io/smart-contract-best-practices/development-recommendations/solidity-specific/interface-types/

  1. https://github.com/code-423n4/2022-04-backed/blob/e8015d7c4b295af131f017e646ba1b99c8f608f0/contracts/NFTLoanFacilitator.sol#L38
  2. https://github.com/code-423n4/2022-04-backed/blob/e8015d7c4b295af131f017e646ba1b99c8f608f0/contracts/NFTLoanFacilitator.sol#L41
  3. https://github.com/code-423n4/2022-04-backed/blob/e8015d7c4b295af131f017e646ba1b99c8f608f0/contracts/NFTLoanFacilitator.sol#L70
  4. https://github.com/code-423n4/2022-04-backed/blob/e8015d7c4b295af131f017e646ba1b99c8f608f0/contracts/NFTLoanFacilitator.sol#L73

Mitigation

Using the interface or contract type rather than just address.

#0 - wilsoncusack

2022-04-08T14:38:14Z

Will consider this

#1 - wilsoncusack

2022-04-15T17:20:42Z

actually probably won't make this change at this point

Awards

32.9299 USDC - $32.93

Labels

bug
G (Gas Optimization)
sponsor acknowledged

External Links

Custom Errors Should Be Used For Gas-optimization

Description

Starting from Solidity v0.8.4, there is a convenient and gas-efficient way to explain to users why an operation failed through the use of custom errors. Until now, you could already use strings to give more information about failures (e.g., revert("Insufficient funds.");), but they are rather expensive, especially when it comes to deploy cost, and it is difficult to use dynamic information in them. Source: https://blog.soliditylang.org/2021/04/21/custom-errors/

  1. https://github.com/code-423n4/2022-04-backed/blob/e8015d7c4b295af131f017e646ba1b99c8f608f0/contracts/NFTLoanFacilitator.sol#L81-L86
  2. https://github.com/code-423n4/2022-04-backed/blob/e8015d7c4b295af131f017e646ba1b99c8f608f0/contracts/NFTLoanFacilitator.sol#L117
  3. https://github.com/code-423n4/2022-04-backed/blob/e8015d7c4b295af131f017e646ba1b99c8f608f0/contracts/NFTLoanFacilitator.sol#L121
  4. https://github.com/code-423n4/2022-04-backed/blob/e8015d7c4b295af131f017e646ba1b99c8f608f0/contracts/NFTLoanFacilitator.sol#L144-L148
  5. https://github.com/code-423n4/2022-04-backed/blob/e8015d7c4b295af131f017e646ba1b99c8f608f0/contracts/NFTLoanFacilitator.sol#L171-L178
  6. https://github.com/code-423n4/2022-04-backed/blob/e8015d7c4b295af131f017e646ba1b99c8f608f0/contracts/NFTLoanFacilitator.sol#L188-L189

Mitigation

Consider using custom errors instead if the contract uses solidity version 0.8.4 or above.

AuditHub

A portfolio for auditors, a security profile for protocols, a hub for web3 security.

Built bymalatrax © 2024

Auditors

Browse

Contests

Browse

Get in touch

ContactTwitter