Platform: Code4rena
Start Date: 18/05/2023
Pot Size: $24,500 USDC
Total HM: 3
Participants: 72
Period: 4 days
Judge: LSDan
Id: 237
League: ETH
Rank: 40/72
Findings: 1
Award: $16.19
🌟 Selected for report: 0
🚀 Solo Findings: 0
🌟 Selected for report: ABA
Also found by: 0x4non, 0xHati, 0xMosh, 0xSmartContract, 0xWaitress, 0xhacksmithh, 0xnev, 0xprinc, Arabadzhiev, BLACK-PANDA-REACH, Deekshith99, Dimagu, KKat7531, Kose, LosPollosHermanos, MohammedRizwan, QiuhaoLi, RaymondFam, Rickard, Rolezn, SAAJ, Sathish9098, Shubham, SmartGooofy, Tripathi, Udsen, V1235816, adriro, arpit, ayden, bigtone, codeVolcan, d3e4, dwward3n, fatherOfBlocks, favelanky, jovemjeune, kutugu, lfzkoala, lukris02, matrix_0wl, minhquanym, ni8mare, parsely, pxng0lin, radev_sw, ravikiranweb3, rbserver, sces60107, souilos, tnevler, turvy_fuzz, yellowBirdy
16.1907 USDC - $16.19
1.Should check if _amountToSend
is greater than 0.
JBXBuybackDelegate.sol#L216#L233
According to uniswap v3 document:
In the implementation you must pay the pool tokens owed for the swap. The caller of this method must be checked to be a UniswapV3Pool deployed by the canonical UniswapV3Factory. amount0Delta and amount1Delta can both be 0 if no tokens were swapped. We should check if the value of `_amountToSend` is greater than 0.
+ if(_amountToSend == 0 ) revert Some_Error();
2.Should check if _reservedRate
is greater than JBConstants.MAX_RESERVED_RATE
JBXBuybackDelegate.sol#L278#L279
JBConstants.MAX_RESERVED_RATE
The value of _reservedRate
is recorded in the payParams function:
reservedRate = _data.reservedRate;
The value of _data.reservedRate
is obtained from the recordPaymentFrom function in the file JBSingleTokenPaymentTerminalStore3_1.sol
:
fundingCycle.reservedRate(),
The reservedRate
function is sourced from the JBFundingCycleMetadataResolver.sol
library:
function reservedRate(JBFundingCycle memory _fundingCycle) internal pure returns (uint256) { return uint256(uint16(_fundingCycle.metadata >> 24)); }
Therefore, the maximum value of _reservedRate
is 65535 (2^16 - 1). It is necessary to check if _amountToSend
is greater than 0.
#0 - c4-judge
2023-06-02T10:59:03Z
dmvt marked the issue as grade-b