Amun contest - csanuragjain's results

We build tokens to make it easy to invest in crypto.

General Information

Platform: Code4rena

Start Date: 13/12/2021

Pot Size: $75,000 USDC

Total HM: 11

Participants: 30

Period: 7 days

Judge: leastwood

Total Solo HM: 4

Id: 68

League: ETH

Amun

Findings Distribution

Researcher Performance

Rank: 4/30

Findings: 2

Award: $4,584.93

🌟 Selected for report: 1

🚀 Solo Findings: 0

External Links

Code4rena Contest Page Github Contest Repository Github Findings Repository Amun

Findings Information

🌟 Selected for report: Czar102

Also found by: csanuragjain

Labels

bug

duplicate

3 (High Risk)

Awards

4506.6046 USDC - $4,506.60

External Links

Link to GitHub issue

Handle

csanuragjain

Vulnerability details

Impact

Although chances are rare but user can be denied to exit pool

Proof of Concept

If user decides to exit pool and any one token has <MIN_AMOUNT then transaction will revert and user wont be able exit until that token has sufficient balance. This means his other tokens will also be stuck and are dependent on this low balance token

#0 - 0xleastwood
2022-01-23T05:23:33Z

Duplicate of #287

Findings Information

🌟 Selected for report: csanuragjain

Labels

bug

G (Gas Optimization)

Awards

78.3316 USDC - $78.33

External Links

Link to GitHub issue

Handle

csanuragjain

Vulnerability details

Impact

Gas overusage

Proof of Concept

https://github.com/code-423n4/2021-12-amun/blob/main/contracts/basket/contracts/facets/ERC20/LibERC20.sol

a. In mint function require(_to != address(0), "INVALID_TO_ADDRESS") is not required as this is internal function and in each call _to cannot be 0 address

https://github.com/code-423n4/2021-12-amun/blob/main/contracts/basket/contracts/facets/Call/CallFacet.sol

a. In removeCaller function callStorage.callers.length can be saved in local variable

https://github.com/code-423n4/2021-12-amun/blob/main/contracts/basket/contracts/facets/Basket/BasketFacet.sol

a. In removeToken function bs.tokens.length can be saved in local variable b. In joinPool function _referral is never used c. In joinPool function, _amount.add(feeAmount) should be calculated once before using in loop d. In calcTokensForAmount function bs.tokens.length can be saved in local variable

https://github.com/code-423n4/2021-12-amun/blob/main/contracts/basket/contracts/singleJoinExit/SingleTokenJoin.sol

a. In _joinTokenSingle function outputToken variable can be used instead of _joinTokenStruct.outputBasket

Amun contest - csanuragjain's results

We build tokens to make it easy to invest in crypto.

General Information

Findings Distribution

Researcher Performance

External Links

[H-02] User funds could be stuck - $4,506.60

Findings Information

Labels

Awards

External Links

Handle

Vulnerability details

Impact

Proof of Concept

#0 - 0xleastwood2022-01-23T05:23:33Z

Gas Report - $78.33

Gas Report - $78.33

🚀 [G-31] Gas savings - $78.33

Findings Information

Labels

Awards

External Links

Handle

Vulnerability details

Impact

Proof of Concept

https://github.com/code-423n4/2021-12-amun/blob/main/contracts/basket/contracts/facets/ERC20/LibERC20.sol

https://github.com/code-423n4/2021-12-amun/blob/main/contracts/basket/contracts/facets/Call/CallFacet.sol

https://github.com/code-423n4/2021-12-amun/blob/main/contracts/basket/contracts/facets/Basket/BasketFacet.sol

https://github.com/code-423n4/2021-12-amun/blob/main/contracts/basket/contracts/singleJoinExit/SingleTokenJoin.sol

#0 - 0xleastwood
2022-01-23T05:23:33Z