PartyDAO contest - The_GUILD's results

A protocol for buying, using, and selling NFTs as a group.

General Information

Platform: Code4rena

Start Date: 12/09/2022

Pot Size: $75,000 USDC

Total HM: 19

Participants: 110

Period: 7 days

Judge: HardlyDifficult

Total Solo HM: 9

Id: 160

League: ETH

PartyDAO

Findings Distribution

Researcher Performance

Rank: 71/110

Findings: 1

Award: $82.34

🌟 Selected for report: 0

🚀 Solo Findings: 0

Lines of code

https://github.com/PartyDAO/party-contracts-c4/blob/3896577b8f0fa16cba129dc2867aba786b730c1b/contracts/distribution/TokenDistributor.sol#L94

Vulnerability details

Impact

The Global Variable is an immutable state variable that cannot be changed after deployment, wrongly setting the address can have a great effect on the performance of the protocol.

Proof of Concept

https://github.com/PartyDAO/party-contracts-c4/blob/3896577b8f0fa16cba129dc2867aba786b730c1b/contracts/distribution/TokenDistributor.sol#L94

Tools Used

A proper check should be done on the address pass in the constructor to make sure address zero is not passed at the point of deployment, this will help to avoid spending extra deployment cost if address 0 is passed as the Admin might want to correct the error by deploying another contract:

#0 - merklejerk

2022-09-22T17:37:55Z

Not worth it imo. We could also easily accidentally set it to a non-zero address we don't control.

#1 - trust1995

2022-10-06T14:08:45Z

I also don't think this is valid

#2 - HardlyDifficult

2022-10-06T14:15:59Z

Seems valid, but NC since this is a constructor they could just deploy again to correct a mistake.

Converting into a QA report for the warden.

#3 - HardlyDifficult

2022-10-06T14:19:45Z

AuditHub

A portfolio for auditors, a security profile for protocols, a hub for web3 security.

Built bymalatrax © 2024

Auditors

Browse

Contests

Browse

Get in touch

ContactTwitter