SIZE contest - Matin's results

An on-chain sealed bid auction protocol.

General Information

Platform: Code4rena

Start Date: 04/11/2022

Pot Size: $42,500 USDC

Total HM: 9

Participants: 88

Period: 4 days

Judge: 0xean

Total Solo HM: 2

Id: 180

League: ETH

SIZE

Findings Distribution

Researcher Performance

Rank: 34/88

Findings: 1

Award: $138.28

🌟 Selected for report: 0

🚀 Solo Findings: 0

Findings Information

🌟 Selected for report: neko_nyaa

Also found by: 8olidity, Bnke0x0, Matin, TwelveSec, brgltd, ctf_sec, djxploit, horsefacts, jayphbee

Labels

bug
2 (Med Risk)
satisfactory
duplicate-48

Awards

138.2838 USDC - $138.28

External Links

Lines of code

https://github.com/code-423n4/2022-11-size/blob/79aa9c01987e57a760521acecfe81b28eab3b313/src/SizeSealed.sol#L358-L387 https://github.com/code-423n4/2022-11-size/blob/79aa9c01987e57a760521acecfe81b28eab3b313/src/SizeSealed.sol#L321-L330 https://github.com/code-423n4/2022-11-size/blob/79aa9c01987e57a760521acecfe81b28eab3b313/src/SizeSealed.sol#L336-L352 https://github.com/code-423n4/2022-11-size/blob/79aa9c01987e57a760521acecfe81b28eab3b313/src/SizeSealed.sol#L409 https://github.com/code-423n4/2022-11-size/blob/79aa9c01987e57a760521acecfe81b28eab3b313/src/SizeSealed.sol#L439

Vulnerability details

Impact

Miscalculation of transferred funds and finally, loss of funds

Proof of Concept

Solmate's safeTransfer() and safeTransferFrom() functions do not check the ext code size of the address of the recipient and so, it may lead to a miscalculation of funds as it returns true for addresses that do not have a contract inside them.

Tools Used

Manual review

Using SafeERC20 instead of solmate

#0 - trust1995

2022-11-08T23:05:49Z

Dup of #309 , but very low quality and vague.

#1 - c4-judge

2022-11-10T00:59:36Z

0xean marked the issue as duplicate

#2 - c4-judge

2022-12-06T00:22:05Z

0xean marked the issue as satisfactory

AuditHub

A portfolio for auditors, a security profile for protocols, a hub for web3 security.

Built bymalatrax © 2024

Auditors

Browse

Contests

Browse

Get in touch

ContactTwitter