Platform: Code4rena
Start Date: 21/06/2022
Pot Size: $30,000 USDC
Total HM: 12
Participants: 96
Period: 3 days
Judge: HardlyDifficult
Total Solo HM: 5
Id: 140
League: ETH
Rank: 34/96
Findings: 2
Award: $47.19
π Selected for report: 0
π Solo Findings: 0
π Selected for report: IllIllI
Also found by: 0x1f8b, 0x29A, 0x52, 0xNazgul, 0xNineDec, 0xc0ffEE, 0xf15ers, 0xkatana, BowTiedWardens, Chom, ElKu, Funen, GalloDaSballo, JC, JMukesh, JohnSmith, Lambda, Limbooo, MadWookie, MiloTruck, Nethermind, Noah3o6, Nyamcil, Picodes, PwnedNoMore, Randyyy, RoiEvenHaim, SmartSek, StErMi, Tadashi, TerrierLover, TomJ, Tomio, Treasure-Seeker, UnusualTurtle, Varun_Verma, Wayne, Waze, _Adam, apostle0x01, asutorufos, berndartmueller, c3phas, catchup, cccz, cloudjunky, codexploder, cryptphi, defsec, delfin454000, dipp, ellahi, exd0tpy, fatherOfBlocks, hansfriese, hyh, joestakey, kebabsec, kenta, masterchief, minhquanym, naps62, oyc_109, pashov, peritoflores, reassor, rfa, robee, sach1r0, saian, sashik_eth, shenwilly, simon135, slywaters, sorrynotsorry, sseefried, unforgiven, xiaoming90, ych18, zuhaibmohd, zzzitron
28.3658 USDC - $28.37
Examples of this issue in the codebase:
File: contracts\NibblVaultFactory.sol missing @return
(Line 38)
File: contracts\NibblVaultFactory.sol missing @return
(Line 64)
File: contracts\NibblVaultFactory.sol missing @return
@param _curator
@param _mix
(Line 80)
constant
s should be defined rather than using magic numbersExamples of this issue in the codebase:
address(0x0)
when assigning values to address state variablesExamples of this issue in the codebase:
Use a solidity version of at least 0.8.12 to get string.concat()
to be used instead of abi.encodePacked(,)
Examples of this issue in the codebase:
abi.encodePacked()
should not be used with dynamic types when passing the result to a hash function such as keccak256()
Examples of this issue in the codebase:
receive()
function will lock Ether in contractIf the intention is for the Ether to be used, the function should call another function, otherwise it should revert Examples of this issue in the codebase:
receive()
function will lock Ether in contractIf the intention is for the Ether to be used, the function should call another function, otherwise, it should revert Examples of this issue in the codebase:
Consider defining in only one contract so that values cannot become out of sync when only one location is updated. If the variable is a local cache of another contract's value, consider making the cache variable internal or private, which will require external users to query the contract with the source of truth, so that callers don't get out of sync.
Example of this issue in the codebase:
factory
is seen in
File: contracts\NibblVault.sol (Line 60)
and
File: contracts\ProxyFault.sol (Line 17)
#0 - HardlyDifficult
2022-07-04T19:23:54Z
All valid considerations
π Selected for report: IllIllI
Also found by: 0v3rf10w, 0x1f8b, 0x29A, 0xKitsune, 0xNazgul, 0xf15ers, 0xkatana, 8olidity, ACai, BowTiedWardens, Chandr, Chom, ElKu, Fitraldys, Funen, IgnacioB, JC, Lambda, Limbooo, MiloTruck, Noah3o6, Nyamcil, Picodes, Randyyy, SmartSek, StErMi, TerrierLover, TomJ, Tomio, UnusualTurtle, Waze, _Adam, ajtra, c3phas, cRat1st0s, catchup, codexploder, cryptphi, defsec, delfin454000, ellahi, exd0tpy, fatherOfBlocks, hansfriese, joestakey, kebabsec, kenta, m_Rassska, minhquanym, oyc_109, pashov, reassor, rfa, robee, sach1r0, saian, sashik_eth, simon135, slywaters, ych18, ynnad, zuhaibmohd
18.8156 USDC - $18.82
Examples of this issue in the codebase:
Examples of this issue in the codebase:
REVERT()/REQUIRE()
STRINGS TO SAVE DEPLOYMENT GASExamples of this issue in the codebase:
SafeMath
AND SafeMath
IS NO LONGER NEEDED STARTING WITH SOLIDITY 0.8Examples of this issue in the codebase:
Examples of this issue in the codebase:
Examples of this issue in the codebase:
Examples of this issue in the codebase:
Examples of this issue in the codebase:
Examples of this issue in the codebase:
See this issue for a detail description of the issue Example of this issue in the codebase:
File: contracts\NibblVault.sol (Line 51)
File: contracts\Utilities\AccessControlMechanism.sol (Line 12)
CallData
INSTEAD OF MEMORYExamples of this issue in the codebase:
File: contracts\NibblVault.sol _assets
can be changed to calldata
(Line 523)
File: contracts\NibblVault.sol _assetAddresses
& _assetIDs
can be changed to calldata
(Line 504)
SLOAD
CALLExamples of this issue in the codebase:
File: contracts\Twav\Twav.sol twavObservationsIndex
can be cached (Line 27)
File: contracts\Twav\Twav.sol twavObservations
can be cached (Line 36)
#0 - mundhrakeshav
2022-06-26T13:33:10Z
https://github.com/code-423n4/2022-06-nibbl-findings/issues/2, https://github.com/code-423n4/2022-06-nibbl-findings/issues/3, https://github.com/code-423n4/2022-06-nibbl-findings/issues/6, https://github.com/code-423n4/2022-06-nibbl-findings/issues/7, https://github.com/code-423n4/2022-06-nibbl-findings/issues/8, https://github.com/code-423n4/2022-06-nibbl-findings/issues/15