OpenLeverage contest - Ruhum's results

Permissionless lending and margin trading protocol that enables traders to long/short any trading pair on DEXs efficiently and securely.

General Information

Platform: Code4rena

Start Date: 27/01/2022

Pot Size: $75,000 USDT

Total HM: 6

Participants: 29

Period: 7 days

Judge: leastwood

Total Solo HM: 6

Id: 72

League: ETH

OpenLeverage

Findings Distribution

Researcher Performance

Rank: 23/29

Findings: 1

Award: $18.25

🌟 Selected for report: 0

🚀 Solo Findings: 0

External Links

Code4rena Contest Page Github Contest Repository Github Findings Repository OpenLeverage

AuditHub

A portfolio for auditors, a security profile for protocols, a hub for web3 security.

Auditors

Browse

Contests

Browse

Get in touch

Contact Twitter

Findings Information

🌟 Selected for report: mics

Also found by: 0x1f8b, Ruhum, gzeon, pauliax, throttle

Labels

bug

duplicate

G (Gas Optimization)

Awards

10.3004 USDT - $10.30

External Links

Link to GitHub issue

Handle

Ruhum

Vulnerability details

Impact

Immutable variables use less gas. The developer state variable seems tobe only set in the constructor of the Adminable contract

Proof of Concept

https://github.com/code-423n4/2022-01-openleverage/blob/main/openleverage-contracts/contracts/Adminable.sol#L9

Tools Used

none

Recommended Mitigation Steps

make immutable

#0 - ColaM12
2022-02-03T06:57:43Z

Duplicate to #11

Findings Information

🌟 Selected for report: mics

Also found by: Dravee, Ruhum, Tomio, WatchPug, defsec, rfa

Labels

bug

duplicate

G (Gas Optimization)

Awards

7.9461 USDT - $7.95

External Links

Link to GitHub issue

Handle

Ruhum

Vulnerability details

Impact

Using calldata is less expensive than memory. It can only be used in external functions tho and the parameter can't be modified.

Proof of Concept

https://github.com/code-423n4/2022-01-openleverage/blob/main/openleverage-contracts/contracts/farming/FarmingPools.sol#L125

https://github.com/code-423n4/2022-01-openleverage/blob/main/openleverage-contracts/contracts/farming/FarmingPools.sol#L131

https://github.com/code-423n4/2022-01-openleverage/blob/main/openleverage-contracts/contracts/farming/FarmingPools.sol#L163

https://github.com/code-423n4/2022-01-openleverage/blob/main/openleverage-contracts/contracts/XOLE.sol#L70

Tools Used

Recommended Mitigation Steps

use calldata wherever you can

#0 - ColaM12
2022-02-03T07:01:26Z

Duplicate to #29

OpenLeverage contest - Ruhum's results

Permissionless lending and margin trading protocol that enables traders to long/short any trading pair on DEXs efficiently and securely.

General Information

Findings Distribution

Researcher Performance

External Links

Gas Report - $18.25

Gas Report - $18.25

[G-04] Make `Adminable.developer` immutable since it's set only once in the constructor - $10.30

Findings Information

Labels

Awards

External Links

Handle

Vulnerability details

Impact

Proof of Concept

Tools Used

Recommended Mitigation Steps

#0 - ColaM122022-02-03T06:57:43Z

[G-15] Use `calldata` for array parameters that aren't modified - $7.95

Findings Information

Labels

Awards

External Links

Handle

Vulnerability details

Impact

Proof of Concept

Tools Used

Recommended Mitigation Steps

#0 - ColaM122022-02-03T07:01:26Z

#0 - ColaM12
2022-02-03T06:57:43Z

#0 - ColaM12
2022-02-03T07:01:26Z