Nouns DAO contest - R2's results

A DAO-driven NFT project on Ethereum.

General Information

Platform: Code4rena

Start Date: 22/08/2022

Pot Size: $50,000 USDC

Total HM: 4

Participants: 160

Period: 5 days

Judge: gzeon

Total Solo HM: 2

Id: 155

League: ETH

Nouns DAO

Findings Distribution

Researcher Performance

Rank: 90/160

Findings: 2

Award: $52.10

🌟 Selected for report: 0

🚀 Solo Findings: 0

  1. Ecrecover

Description: In some cases ecrecover can return a random address instead of 0 for an invalid signature So a malisious user will be able to add vote without tokens

Code: https://github.com/code-423n4/2022-08-nounsdao/blob/452695d4764ba9d5e1d3eef0d5ecca3d004f215a/contracts/governance/NounsDAOLogicV2.sol#L576

https://github.com/code-423n4/2022-08-nounsdao/blob/452695d4764ba9d5e1d3eef0d5ecca3d004f215a/contracts/base/ERC721Checkpointable.sol#L139

How to fix: Receive additional variable (e.g. address voter) and check that the ecrecover returned value matches with 'voter'

  1. Not pausable

Description: There is no way to pause all interactions with your DAO contracts. So if you find a critical vulnerability or your private keys are stolen, you may need to stop all requests to the contract immediately

  1. Only vetoer can change vetoer

Description: If as a result of an error you set an incorrect address for vetoer, you can't change it anymore. And then malicious user can provide sybil attack

How to fix: Admin should be able to change vetoer

  1. Admin account controlled by one private key

Description: If a private key will be compromised, you will lose contracts control. And then malicious user can steel all funds

How to fix: Use multisignature access to admin

  1. function "propose"

Code: https://github.com/code-423n4/2022-08-nounsdao/blob/45411325ec14c6d747b999a40367d3c5109b5a89/contracts/governance/NounsDAOLogicV1.sol#L174

How to reduce gas usage:

  • public -> external
  • receive array arguments as 'calldata', not 'memory'
  • no need to explicitly set 0 to variables like eta, forVotes, againstVotes, abstainVotes, canceled, executed, vetoed. Their default value already 0
  1. functions "cancel" and "veto"

How to reduce gas usage:

  • no need to call timelock.cancelTransaction if transactions were not sended to timelock yet (you can check status)
AuditHub

A portfolio for auditors, a security profile for protocols, a hub for web3 security.

Built bymalatrax © 2024

Auditors

Browse

Contests

Browse

Get in touch

ContactTwitter