Debt DAO contest - corerouter's results

A cryptonative credit marketplace for fully anon and trustless loans to DAOs.

General Information

Platform: Code4rena

Start Date: 03/11/2022

Pot Size: $115,500 USDC

Total HM: 17

Participants: 120

Period: 7 days

Judge: LSDan

Total Solo HM: 1

Id: 174

League: ETH

Debt DAO

Findings Distribution

Researcher Performance

Rank: 120/120

Findings: 1

Award: $2.67

🌟 Selected for report: 0

🚀 Solo Findings: 0

Awards

2.6694 USDC - $2.67

Labels

bug
2 (Med Risk)
partial-50
duplicate-369

External Links

Lines of code

https://github.com/code-423n4/2022-11-debtdao/blob/update-readme/contracts/utils/LineLib.sol#L48

Vulnerability details

Impact

Transfer() has typically been recommended by the security community because it helps guard against reentrancy attacks. Any smart contract that uses transfer() or send() is taking a hard dependency on gas costs by forwarding a fixed amount of gas: 2300. It works under the assumption that gas costs wouldn’t change, but that assumption turned out to be incorrect since the Istanbul hard fork. As a result, the transfer() functions may fail frequently due to limited gas.

Proof of Concept

https://github.com/code-423n4/2022-11-debtdao/blob/update-readme/contracts/utils/LineLib.sol#L48

Tools Used

Now it is recommended to stop using transfer() and switch to using call() instead.

#0 - c4-judge

2022-11-17T11:59:58Z

dmvt marked the issue as duplicate of #14

#1 - c4-judge

2022-11-17T19:19:07Z

dmvt marked the issue as partial-50

#2 - C4-Staff

2022-12-20T05:56:43Z

liveactionllama marked the issue as duplicate of #369

AuditHub

A portfolio for auditors, a security profile for protocols, a hub for web3 security.

Built bymalatrax © 2024

Auditors

Browse

Contests

Browse

Get in touch

ContactTwitter