Platform: Code4rena
Start Date: 14/06/2022
Pot Size: $100,000 USDC
Total HM: 26
Participants: 59
Period: 7 days
Judge: GalloDaSballo
Total Solo HM: 9
Id: 133
League: ETH
Rank: 45/59
Findings: 2
Award: $287.34
🌟 Selected for report: 0
🚀 Solo Findings: 0
🌟 Selected for report: joestakey
Also found by: 0x1f8b, 0x29A, 0x52, 0xDjango, 0xNazgul, 0xf15ers, 0xmint, Bronicle, Dravee, Funen, JMukesh, Limbooo, MadWookie, Picodes, Ruhum, TerrierLover, TomJ, Tutturu, WatchPug, Waze, _Adam, asutorufos, c3phas, catchup, cccz, codexploder, cryptphi, csanuragjain, defsec, fatherOfBlocks, gzeon, hake, hansfriese, hyh, ignacio, k, nxrblsrpr, oyc_109, robee, sach1r0, saian, simon135, technicallyty, zzzitron
72.4555 USDC - $72.46
687.9945 CANTO - $111.11
address(0x0)
when assigning values to address state variablesaddress(0x0)
1. File: TreasuryDelegator.sol#L21
admin = admin_;
transfer
call
instead like so(bool success, ) = payable(msg.sender).call.value(wad)("");
payable(msg.sender).transfer(wad);
1. File: GovernorBravoInterfaces.sol#L31
IProposal unigov; //Proposal Store object defined as primitive contract in Canto-Testnet <URL HERE>
#0 - GalloDaSballo
2022-08-02T20:52:30Z
L
You can't say WETH, one of the most used contracts, has an unsafe transfer, and keep a straight face
Disagree as this is the storage contract meant to list all the storage variables
Really low quality submission
1L
🌟 Selected for report: _Adam
Also found by: 0v3rf10w, 0x1f8b, 0x29A, 0xKitsune, 0xNazgul, 0xf15ers, 0xkatana, 0xmint, Chom, Dravee, Fitraldys, Funen, JC, Limbooo, MadWookie, Picodes, Ruhum, TerrierLover, TomJ, Tomio, Waze, ak1, c3phas, catchup, defsec, fatherOfBlocks, gzeon, hake, hansfriese, joestakey, k, oyc_109, rfa, robee, sach1r0, saian, simon135, ynnad
39.6748 USDC - $39.67
396.9199 CANTO - $64.10
uint
is 0 and the default value for bool
is false1. File:GovernorBravoDelegate.sol#L57
newProposal.eta = 0;
2. File:GovernorBravoDelegate.sol#L62
newProposal.canceled = false;
add256()
and sub256()
are not needed as solidity version 0.8.10 has built-in overflow/underflow checking.1. File:GovernorBravoDelegate.sol#L180-184
function add256(uint256 a, uint256 b) internal pure returns (uint) { uint c = a + b; require(c >= a, "addition overflow"); return c; }
2. File:GovernorBravoDelegate.sol#L186-189
function sub256(uint256 a, uint256 b) internal pure returns (uint) { require(b <= a, "subtraction underflow"); return a - b; }
#0 - GalloDaSballo
2022-08-04T00:33:04Z
6 gas on the defaults 20 gas on the checked