Juicebox Buyback Delegate - ayden's results

Thousands of projects use Juicebox to fund, operate, and scale their ideas & communities transparently on Ethereum.

General Information

Platform: Code4rena

Start Date: 18/05/2023

Pot Size: $24,500 USDC

Total HM: 3

Participants: 72

Period: 4 days

Judge: LSDan

Id: 237

League: ETH

Juicebox

Findings Distribution

Researcher Performance

Rank: 40/72

Findings: 1

Award: $16.19

QA:
grade-b

🌟 Selected for report: 0

🚀 Solo Findings: 0

1.Should check if _amountToSend is greater than 0. JBXBuybackDelegate.sol#L216#L233 According to uniswap v3 document:

In the implementation you must pay the pool tokens owed for the swap. The caller of this method must be checked to be a UniswapV3Pool deployed by the canonical UniswapV3Factory. amount0Delta and amount1Delta can both be 0 if no tokens were swapped. We should check if the value of `_amountToSend` is greater than 0.
+ if(_amountToSend == 0 ) revert Some_Error();

2.Should check if _reservedRate is greater than JBConstants.MAX_RESERVED_RATE JBXBuybackDelegate.sol#L278#L279 JBConstants.MAX_RESERVED_RATE The value of _reservedRate is recorded in the payParams function:

    reservedRate = _data.reservedRate;

The value of _data.reservedRate is obtained from the recordPaymentFrom function in the file JBSingleTokenPaymentTerminalStore3_1.sol:

    fundingCycle.reservedRate(),

The reservedRate function is sourced from the JBFundingCycleMetadataResolver.sol library:

function reservedRate(JBFundingCycle memory _fundingCycle) internal pure returns (uint256) {
  return uint256(uint16(_fundingCycle.metadata >> 24));
}

Therefore, the maximum value of _reservedRate is 65535 (2^16 - 1). It is necessary to check if _amountToSend is greater than 0.

#0 - c4-judge

2023-06-02T10:59:03Z

dmvt marked the issue as grade-b

AuditHub

A portfolio for auditors, a security profile for protocols, a hub for web3 security.

Built bymalatrax © 2024

Auditors

Browse

Contests

Browse

Get in touch

ContactTwitter