SIZE contest - Rahoz's results

An on-chain sealed bid auction protocol.

General Information

Platform: Code4rena

Start Date: 04/11/2022

Pot Size: $42,500 USDC

Total HM: 9

Participants: 88

Period: 4 days

Judge: 0xean

Total Solo HM: 2

Id: 180

League: ETH

SIZE

Findings Distribution

Researcher Performance

Rank: 54/88

Findings: 1

Award: $44.29

QA:
grade-b

🌟 Selected for report: 0

🚀 Solo Findings: 0

Awards

44.2869 USDC - $44.29

Labels

bug
grade-b
QA (Quality Assurance)
Q-07

External Links

L. MISSING NATSPEC

Code should include NatSpec AuctionParameters.merkleRoot EncryptedBid AuctionData

Proof of Concept

https://github.com/code-423n4/2022-11-size/blob/706a77e585d0852eae6ba0dca73dc73eb37f8fb6/src/interfaces/ISizeSealed.sol#L82 https://github.com/code-423n4/2022-11-size/blob/706a77e585d0852eae6ba0dca73dc73eb37f8fb6/src/interfaces/ISizeSealed.sol#L40-L48 https://github.com/code-423n4/2022-11-size/blob/706a77e585d0852eae6ba0dca73dc73eb37f8fb6/src/interfaces/ISizeSealed.sol#L63-L68

N. FUNCTION ORDER

Functions should be ordered following the Solidity conventions. Link: https://docs.soliditylang.org/en/v0.8.15/style-guide.html#order-of-functions

Proof of Concept

https://github.com/code-423n4/2022-11-size/blob/main/src/SizeSealed.sol

N. INTERFACE FILES SHOULD USE FLOATING COMPILER VERSIONS

Floating pragmas make sense for libraries to allow them to be included with multiple different versions of applications, it may be a security risk for application implementations.

Proof of Concept

https://github.com/code-423n4/2022-11-size/blob/706a77e585d0852eae6ba0dca73dc73eb37f8fb6/src/interfaces/ISizeSealed.sol#L2 https://github.com/code-423n4/2022-11-size/blob/706a77e585d0852eae6ba0dca73dc73eb37f8fb6/src/util/ECCMath.sol#L2

Should use floating versions

N. EVENT IS MISSING INDEXED FIELDS

Index event fields make the field more quickly accessible to off-chain tools that parse events.

Proof of Concept

https://github.com/code-423n4/2022-11-size/blob/706a77e585d0852eae6ba0dca73dc73eb37f8fb6/src/interfaces/ISizeSealed.sol#L97-L122

We should add indexed for auctionId in event AuctionCreated, AuctionCancelled, Bid,BidCancelled, RevealedKey, AuctionFinalized, BidRefund,Withdrawal,

#0 - c4-judge

2022-11-10T02:45:21Z

0xean marked the issue as grade-b

AuditHub

A portfolio for auditors, a security profile for protocols, a hub for web3 security.

Built bymalatrax © 2024

Auditors

Browse

Contests

Browse

Get in touch

ContactTwitter