Platform: Code4rena
Start Date: 04/05/2022
Pot Size: $50,000 DAI
Total HM: 24
Participants: 71
Period: 5 days
Judge: Justin Goro
Total Solo HM: 14
Id: 119
League: ETH
Rank: 27/71
Findings: 4
Award: $180.71
🌟 Selected for report: 0
🚀 Solo Findings: 0
🌟 Selected for report: cccz
Also found by: 0x52, 0xYamiDancho, GimelSec, IllIllI, PPrieditis, WatchPug, csanuragjain, danb, gzeon, hickuphh3, horsefacts, hyh, kenzo, leastwood, reassor, unforgiven
63.9296 DAI - $63.93
https://github.com/code-423n4/2022-05-factorydao/blob/main/contracts/FixedPricePassThruGate.sol#L46 https://github.com/code-423n4/2022-05-factorydao/blob/main/contracts/SpeedBumpPriceGate.sol#L65
If user has passed excess eth than required in gate.ethCost then the excess eth is not returned back to the user and user loses the excess eth amount
msg.value-gate.ethCost must be returned back to msg.sender
#0 - illuzen
2022-05-10T07:42:11Z
Valid
#1 - gititGoro
2022-06-14T03:20:00Z
Duplicate of #48
🌟 Selected for report: MaratCerby
Also found by: 0x1337, 0x52, 0xYamiDancho, AuditsAreUS, CertoraInc, Dravee, GimelSec, IllIllI, PPrieditis, Ruhum, TrungOre, VAD37, berndartmueller, cccz, csanuragjain, defsec, hickuphh3, horsefacts, hyh, jayjonah8, kenzo, leastwood, mtz, p4st13r4, reassor, throttle, wuwe1, ych18
3.1753 DAI - $3.18
Transfer fees are not considered if any which may depict incorrect amount in pool.rewardFunding[i]
Observe the fundPool function
pool.rewardFunding[i] += amount; is not considering transfer fees if any on PermissionlessBasicPoolFactory.sol#L144
This means pool.rewardFunding[i] will show higher amount than actually present in contract
pool.rewardFunding[i] should be updated with actual amount transferred to contract
#0 - illuzen
2022-05-10T07:41:45Z
🌟 Selected for report: horsefacts
Also found by: 0x1f8b, 0xYamiDancho, 0xf15ers, 0xkatana, ACai, AlleyCat, Bruhhh, Dravee, Funen, GimelSec, Hawkeye, IllIllI, MaratCerby, PPrieditis, Picodes, Ruhum, TerrierLover, VAD37, berndartmueller, csanuragjain, defsec, delfin454000, eccentricexit, ellahi, fatherOfBlocks, gzeon, hansfriese, hickuphh3, hyh, ilan, joestakey, juicy, kebabsec, oyc_109, rajatbeladiya, reassor, rfa, robee, samruna, simon135, sorrynotsorry, throttle
74.5546 DAI - $74.55
No emergency withdraw function. Under emergency, contract would want its users to be able to withdraw there deposited amount without caring about rewards.
#0 - illuzen
2022-05-10T07:41:31Z
Duplicate
🌟 Selected for report: IllIllI
Also found by: 0x1f8b, 0xNazgul, 0xYamiDancho, 0xf15ers, 0xkatana, ACai, CertoraInc, Dravee, Funen, GimelSec, Hawkeye, PPrieditis, Picodes, Ruhum, TerrierLover, Tomio, VAD37, Waze, csanuragjain, defsec, delfin454000, eccentricexit, ellahi, fatherOfBlocks, gzeon, hansfriese, horsefacts, ilan, joestakey, juicy, minhquanym, oyc_109, rajatbeladiya, reassor, rfa, robee, samruna, simon135, z3s
39.0536 DAI - $39.05
depositTokens: check value!=0
depositTokens: check value!=0
deposit: check amount!=0 for saving gas
fundPool: If success turns false then code should break from loop
withdraw: If success turns false then code should break from loop
#0 - illuzen
2022-05-10T07:41:05Z
Debatable, are we optimizing gas for rare worst case scenario or typical case, because adding checks slows down common case.
#1 - gititGoro
2022-06-05T00:41:28Z
Gas optimizations for rare edge cases will generally be given lower scoring or ignored, especially if they obstruct the common case and especially if the UI can shield users from travelling down wasteful paths such as entering zero in the amount field.