Back to aphak5010's contests

LooksRare Aggregator contest - aphak5010's results

An NFT aggregator protocol.

General Information

Platform: Code4rena

Start Date: 08/11/2022

Pot Size: $60,500 USDC

Total HM: 6

Participants: 72

Period: 5 days

Judge: Picodes

Total Solo HM: 2

Id: 178

League: ETH

LooksRare

Findings Distribution

Researcher Performance

Rank: 66/72

Findings: 1

Award: $36.34

QA:
grade-b

🌟 Selected for report: 0

🚀 Solo Findings: 0

External Links

Code4rena Contest PageGithub Contest RepositoryGithub Findings RepositoryLooksRare

Findings Information

🌟 Selected for report: RaymondFam

Also found by: 0x1f8b, 0x52, 0xSmartContract, 0xc0ffEE, 0xhacksmithh, 8olidity, Awesome, BClabs, Bnke0x0, Chom, Deivitto, Hashlock, IllIllI, Josiah, KingNFT, Nyx, R2, ReyAdmirado, Rolezn, SamGMK, Sathish9098, SinceJuly, V_B, Vadis, Waze, a12jmx, adriro, ajtra, aphak5010, bearonbike, bin, brgltd, carlitox477, carrotsmuggler, cccz, ch0bu, chaduke, datapunk, delfin454000, erictee, fatherOfBlocks, fs0c, horsefacts, jayphbee, ktg, ladboy233, pashov, perseverancesuccess, rbserver, ret2basic, tnevler, zaskoh

Awards

36.3434 USDC - $36.34

Labels

bug
grade-b
judge review requested
QA (Quality Assurance)
edited-by-warden
Q-06

External Links

Link to GitHub issue

LooksRare Aggregator Low Risk and Non-Critical Issues

Summary

RiskTitleFileInstances
L-00Children of OwnableTwoSteps should set delayOwnableTwoSteps.sol-
N-00Unlocked pragma-11
N-01Different compiler versions-11
N-02Event is missing indexed fields-8

[L-00] Children of OwnableTwoSteps should set delay

In the OwnableTwoSteps contract, function _setupDelayForRenouncingOwnership it is stated that "This function is expected to be included in the constructor of the contract that inherits this contract.".

https://github.com/code-423n4/2022-11-looksrare/blob/d8949e1c527e0544027370969f970c4194b10640/contracts/OwnableTwoSteps.sol#L122

The OwnableTwoSteps contract is inherited by TokenRescuer which in turn is inherited by LooksRareProxy, SeaportProxy and LooksRareAggregator.
None of the children calls the _setupDelayForRenouncingOwnership function in their constructor.

This means there is no timelock to renounce ownership.

[N-00] Unlocked pragma

It is considered best practice to use a locked Solidity version, thereby only allowing compilation with a specific version.

There are 11 instances of this.

https://github.com/code-423n4/2022-11-looksrare/blob/d8949e1c527e0544027370969f970c4194b10640/contracts/ReentrancyGuard.sol#L2

https://github.com/code-423n4/2022-11-looksrare/blob/d8949e1c527e0544027370969f970c4194b10640/contracts/OwnableTwoSteps.sol#L2

https://github.com/code-423n4/2022-11-looksrare/blob/d8949e1c527e0544027370969f970c4194b10640/contracts/SignatureChecker.sol#L2

https://github.com/code-423n4/2022-11-looksrare/blob/d8949e1c527e0544027370969f970c4194b10640/contracts/lowLevelCallers/LowLevelERC20Approve.sol#L2

https://github.com/code-423n4/2022-11-looksrare/blob/d8949e1c527e0544027370969f970c4194b10640/contracts/lowLevelCallers/LowLevelERC20Transfer.sol#L4

https://github.com/code-423n4/2022-11-looksrare/blob/d8949e1c527e0544027370969f970c4194b10640/contracts/lowLevelCallers/LowLevelERC721Transfer.sol#L2

https://github.com/code-423n4/2022-11-looksrare/blob/d8949e1c527e0544027370969f970c4194b10640/contracts/lowLevelCallers/LowLevelERC1155Transfer.sol#L2

https://github.com/code-423n4/2022-11-looksrare/blob/d8949e1c527e0544027370969f970c4194b10640/contracts/lowLevelCallers/LowLevelETH.sol#L2

https://github.com/code-423n4/2022-11-looksrare/blob/d8949e1c527e0544027370969f970c4194b10640/contracts/interfaces/IERC20.sol#L2

https://github.com/code-423n4/2022-11-looksrare/blob/d8949e1c527e0544027370969f970c4194b10640/contracts/interfaces/IERC721.sol#L2

https://github.com/code-423n4/2022-11-looksrare/blob/d8949e1c527e0544027370969f970c4194b10640/contracts/interfaces/IERC1155.sol#L2

[N-01] Different compiler versions

Across the repository, there are 3 different pragmas used:
0.8.17, ^0.8.14 and ^0.8.0.
While all three can be compiled with the same Solidity version (0.8.17), it is best practice to use a single pragme consistenly in all files.
So consider using 0.8.17 for all files.

There are 11 instances of files that use a different pragma:

https://github.com/code-423n4/2022-11-looksrare/blob/d8949e1c527e0544027370969f970c4194b10640/contracts/ReentrancyGuard.sol#L2

https://github.com/code-423n4/2022-11-looksrare/blob/d8949e1c527e0544027370969f970c4194b10640/contracts/OwnableTwoSteps.sol#L2

https://github.com/code-423n4/2022-11-looksrare/blob/d8949e1c527e0544027370969f970c4194b10640/contracts/SignatureChecker.sol#L2

https://github.com/code-423n4/2022-11-looksrare/blob/d8949e1c527e0544027370969f970c4194b10640/contracts/lowLevelCallers/LowLevelERC20Approve.sol#L2

https://github.com/code-423n4/2022-11-looksrare/blob/d8949e1c527e0544027370969f970c4194b10640/contracts/lowLevelCallers/LowLevelERC20Transfer.sol#L4

https://github.com/code-423n4/2022-11-looksrare/blob/d8949e1c527e0544027370969f970c4194b10640/contracts/lowLevelCallers/LowLevelERC721Transfer.sol#L2

https://github.com/code-423n4/2022-11-looksrare/blob/d8949e1c527e0544027370969f970c4194b10640/contracts/lowLevelCallers/LowLevelERC1155Transfer.sol#L2

https://github.com/code-423n4/2022-11-looksrare/blob/d8949e1c527e0544027370969f970c4194b10640/contracts/lowLevelCallers/LowLevelETH.sol#L2

https://github.com/code-423n4/2022-11-looksrare/blob/d8949e1c527e0544027370969f970c4194b10640/contracts/interfaces/IERC20.sol#L2

https://github.com/code-423n4/2022-11-looksrare/blob/d8949e1c527e0544027370969f970c4194b10640/contracts/interfaces/IERC721.sol#L2

https://github.com/code-423n4/2022-11-looksrare/blob/d8949e1c527e0544027370969f970c4194b10640/contracts/interfaces/IERC1155.sol#L2

[N-02] Event is missing indexed fields

Each event should use three indexed fields if it has three or more fields.

There are 8 instances of events that do not have 3 indexed fields.

https://github.com/code-423n4/2022-11-looksrare/blob/d8949e1c527e0544027370969f970c4194b10640/contracts/interfaces/ILooksRareAggregator.sol#L44

https://github.com/code-423n4/2022-11-looksrare/blob/d8949e1c527e0544027370969f970c4194b10640/contracts/interfaces/ILooksRareAggregator.sol#L51

https://github.com/code-423n4/2022-11-looksrare/blob/d8949e1c527e0544027370969f970c4194b10640/contracts/interfaces/ILooksRareAggregator.sol#L58

https://github.com/code-423n4/2022-11-looksrare/blob/d8949e1c527e0544027370969f970c4194b10640/contracts/interfaces/IERC20.sol#L5

https://github.com/code-423n4/2022-11-looksrare/blob/d8949e1c527e0544027370969f970c4194b10640/contracts/interfaces/IERC20.sol#L7

https://github.com/code-423n4/2022-11-looksrare/blob/d8949e1c527e0544027370969f970c4194b10640/contracts/interfaces/IERC721.sol#L9

https://github.com/code-423n4/2022-11-looksrare/blob/d8949e1c527e0544027370969f970c4194b10640/contracts/interfaces/IERC1155.sol#L15

https://github.com/code-423n4/2022-11-looksrare/blob/d8949e1c527e0544027370969f970c4194b10640/contracts/interfaces/IERC1155.sol#L17

#0 - c4-judge

2022-11-21T19:50:27Z

Picodes marked the issue as grade-b

#1 - 0xhiroshi

2022-11-23T00:00:54Z

Addressed in other issues

#2 - 0xhiroshi

2022-11-23T10:22:53Z

Update: L-00 is valid, we are going to set up delay in LooksRareAggregator's constructor and we are going to remove TokenRescuer from all proxies, they are not required anymore as they are only being delegatecall into (We used to use call instead of delegatecall)

#3 - 0xhiroshi

2022-11-23T10:23:10Z

@0xJurassicPunk ☝️

#4 - c4-sponsor

2022-11-25T00:20:00Z

0xhiroshi requested judge review

AuditHub

A portfolio for auditors, a security profile for protocols, a hub for web3 security.

Built bymalatrax © 2024

Auditors

Browse

Contests

Browse

Get in touch

ContactTwitter