Platform: Code4rena
Start Date: 31/08/2023
Pot Size: $55,000 USDC
Total HM: 5
Participants: 30
Period: 6 days
Judge: hickuphh3
Total Solo HM: 2
Id: 282
League: ETH
Rank: 15/30
Findings: 1
Award: $458.20
🌟 Selected for report: 1
🚀 Solo Findings: 0
🌟 Selected for report: Proxy
Also found by: Banditx0x, DavidGiladi, favelanky, ladboy233, nadin, rvierdiiev
458.1987 USDC - $458.20
Total Low Risk Issues | 3 |
---|
Count | Title | Instances |
---|---|---|
L-01 | There is no way to decrease the max number of active transcoders | 1 |
L-02 | When removing transcoders Transcoder.activationRound should be set to 0 for inactive | 1 |
L-03 | No function implemented for setMaxEarningsClaimsRounds() | 1 |
Total Non-Critical Issues | 2 |
---|
setNumActiveTranscoders()
sets the maximum number of active transcoders however there is no way to decrease the number since setMaxSize()
does not allow it.
function setNumActiveTranscoders(uint256 _numActiveTranscoders) external onlyControllerOwner { transcoderPool.setMaxSize(_numActiveTranscoders); emit ParameterUpdate("numActiveTranscoders"); }
function setMaxSize(Data storage self, uint256 _size) public { require(_size > self.maxSize, "new max size must be greater than old max size"); self.maxSize = _size; }
Transcoder.activationRound
should be set to 0 for inactiveFunction tryToJoinActiveSet()
removes a transcoder if transcoderPool.isFull()
however it does not set Transcoder.activationRound
of the transcoder to 0 for inactive.
In Transcoder
struct it says if a transcoder is inactive activationRound
should be 0.
uint256 activationRound; // Round in which the transcoder became active - 0 if inactive
transcoderPool.remove(lastTranscoder); transcoders[lastTranscoder].deactivationRound = _activationRound; // @audit Transcoder.activationRound should be 0 - for inactive pendingNextRoundTotalActiveStake = pendingNextRoundTotalActiveStake.sub(lastStake);
setMaxEarningsClaimsRounds()
The constructor natspec says that setMaxEarningsClaimsRounds()
should be called to initialize state variables post-deployment. However there is no such function implemented anywhere
/** * @notice BondingManager constructor. Only invokes constructor of base Manager contract with provided Controller address * @dev This constructor will not initialize any state variables besides `controller`. The following setter functions * should be used to initialize state variables post-deployment: * - setUnbondingPeriod() * - setNumActiveTranscoders() * - setMaxEarningsClaimsRounds() * @param _controller Address of Controller that this contract will be registered with */
// @audit Typo - instead of "specicic" use "specific" 35: // @dev Tracks state of specicic voters in a single proposal. // @audit Typo - instead of "abstain" use "against" 59: // @notice The required percentage of "for" votes in relation to the total opinionated votes (for and abstain) for
// @audit Typo - instead of "Notce that..." use "Notice that this is different" 65: // @dev Stores a list of checkpoints for the total active stake, queryable and mapped by round. Notce that 66: // differently from bonding checkpoints, it's only accessible on the specific round. To access the checkpoint for a
Some functions say they set one thing but set something different and some function names are too ambiguous.
setTreasuryRewardCutRate()
and _setTreasuryRewardCutRate() set nextRoundTreasuryRewardCutRate
not treasuryRewardCutRate
transcoder()
and transcoderWithHint()
are too ambiguous
#0 - 141345
2023-09-09T15:36:43Z
#1 - c4-pre-sort
2023-09-09T15:53:32Z
141345 marked the issue as high quality report
#2 - victorges
2023-09-15T18:44:42Z
This is known and expected behavior, which has an explicit check in the code to guarantee consistency. An improvement could be made to the code but the current one works as expected.
Valid point on doc that oversimplifies the behavior of the field and can be confusing. In the way these fields are read, that 0 value wouldn't matter though: https://github.com/livepeer/protocol/blob/ca3f5bb7a65dedba0f6be6a341d184c48553be98/contracts/bonding/BondingManager.sol#L1159
Misleading docs. Probably a deprecated property that doesn't exist anymore. Here's the deploy code of that contract for reference: https://github.com/code-423n4/2023-08-livepeer/blob/23bd30274c4d426c4bb01da661ad3ef2480c6494/deploy/deploy_contracts.ts#L215-L230
Good docs improvements
Valid points, but expected behavior, might not fix.
#3 - c4-sponsor
2023-09-15T18:45:22Z
victorges (sponsor) confirmed
#4 - c4-judge
2023-09-20T10:41:36Z
HickupHH3 marked the issue as grade-b
#5 - c4-judge
2023-09-21T10:23:39Z
HickupHH3 marked the issue as grade-a
#6 - HickupHH3
2023-09-22T03:45:51Z
L-01: R L-02: R L-03: L NC-01: NC NC-02: R
1L 3R 1NC
#7 - c4-judge
2023-09-22T03:46:11Z
HickupHH3 marked the issue as selected for report