Platform: Code4rena
Start Date: 10/02/2022
Pot Size: $30,000 USDC
Total HM: 5
Participants: 24
Period: 3 days
Judge: harleythedog
Total Solo HM: 3
Id: 86
League: ETH
Rank: 15/24
Findings: 2
Award: $160.19
🌟 Selected for report: 0
🚀 Solo Findings: 0
84.6193 USDC - $84.62
https://github.com/code-423n4/2022-02-nested/blob/main/contracts/FeeSplitter.sol
Fee distributions can be changed unilaterally at the expense of Nested portfolio creator.
Manual audit
Lock fees for the duration of the portfolio. Any future fee split change should not affect an already existing NFT.
#0 - maximebrugel
2022-02-11T14:32:03Z
This is more "a request" and not a vulnerability. This mechanism is intentional.
#1 - harleythedogC4
2022-02-27T16:53:34Z
Agree with the sponsor that this isn't an actual vulnerability. The portfolio creator still keeps their previously accumulated fees if the fee distribution changes, its just that any new calls to _sendFees
will not send as many tokens for royalties as it did before. I am going to mark this as low severity.
#2 - harleythedogC4
2022-03-03T01:31:29Z
(Now considering as a QA report) My personal judgements:
#3 - harleythedogC4
2022-03-03T02:29:00Z
Now, here is the methodology I used for calculating a score for each QA report. I first assigned each submission to be either non-critical (1 point), very-low-critical (5 points) or low-critical (10 points), depending on how severe/useful the issue is. The score of a QA report is the sum of these points, divided by the maximum number of points achieved by a QA report. This maximum number was 26 points, achieved by https://github.com/code-423n4/2022-02-nested-findings/issues/66.
The number of points achieved by this report is 1points. Thus the final score of this QA report is (1/26)*100 = 4.
#4 - CloudEllie
2022-03-24T15:42:25Z
Since this issue was downgraded to a QA level, and the warden did not submit a separate QA report, we've renamed this one to "QA report" for consistency.
The original title, for the record, was "Fee distributions can be changed unilaterally."
🌟 Selected for report: pauliax
Also found by: 0x1f8b, Dravee, GreyArt, Omik, ShippooorDAO, Tomio, bobi, cmichel, csanuragjain, defsec, gzeon, kenta, kenzo, m_smirnova2020, rfa, robee, sirhashalot, ye0lde
75.5694 USDC - $75.57
#0 - maximebrugel
2022-02-18T17:46:43Z
#1 - harleythedogC4
2022-03-13T03:23:38Z
My personal judgment: Valid and small-optimization
#2 - harleythedogC4
2022-03-13T06:19:53Z
Now, here is the methodology I used for calculating a score for each gas report. I first assigned each submission to be either small-optimization (1 point), medium-optimization (5 points) or large-optimization (10 points), depending on how useful the optimization is. The score of a gas report is the sum of these points, divided by the maximum number of points achieved by a gas report. This maximum number was 10 points, achieved by #67.
The number of points achieved by this report is 1 points. Thus the final score of this gas report is (1/10)*100 = 10.