FactoryDAO contest - csanuragjain's results

The DAO that builds DAOs.

General Information

Platform: Code4rena

Start Date: 04/05/2022

Pot Size: $50,000 DAI

Total HM: 24

Participants: 71

Period: 5 days

Judge: Justin Goro

Total Solo HM: 14

Id: 119

League: ETH

FactoryDAO

Findings Distribution

Researcher Performance

Rank: 27/71

Findings: 4

Award: $180.71

🌟 Selected for report: 0

🚀 Solo Findings: 0

Findings Information

Awards

63.9296 DAI - $63.93

Labels

bug
duplicate
3 (High Risk)
sponsor confirmed

External Links

Lines of code

https://github.com/code-423n4/2022-05-factorydao/blob/main/contracts/FixedPricePassThruGate.sol#L46 https://github.com/code-423n4/2022-05-factorydao/blob/main/contracts/SpeedBumpPriceGate.sol#L65

Vulnerability details

Impact

If user has passed excess eth than required in gate.ethCost then the excess eth is not returned back to the user and user loses the excess eth amount

Proof of Concept

  1. Assume gate.ethCost is 5
  2. User calls passThruGate function at FixedPricePassThruGate.sol#L46 with msg.value as 6
  3. The contract will keep the excess 6-5=1 eth amount with itself and not refund the same to user

msg.value-gate.ethCost must be returned back to msg.sender

#0 - illuzen

2022-05-10T07:42:11Z

Valid

#1 - gititGoro

2022-06-14T03:20:00Z

Duplicate of #48

Awards

3.1753 DAI - $3.18

Labels

bug
duplicate
2 (Med Risk)

External Links

Lines of code

https://github.com/code-423n4/2022-05-factorydao/blob/main/contracts/PermissionlessBasicPoolFactory.sol#L146

Vulnerability details

Impact

Transfer fees are not considered if any which may depict incorrect amount in pool.rewardFunding[i]

Proof of Concept

  1. Observe the fundPool function

  2. pool.rewardFunding[i] += amount; is not considering transfer fees if any on PermissionlessBasicPoolFactory.sol#L144

  3. This means pool.rewardFunding[i] will show higher amount than actually present in contract

pool.rewardFunding[i] should be updated with actual amount transferred to contract

https://github.com/code-423n4/2022-05-factorydao/blob/main/contracts/PermissionlessBasicPoolFactory.sol

No emergency withdraw function. Under emergency, contract would want its users to be able to withdraw there deposited amount without caring about rewards.

#0 - illuzen

2022-05-10T07:41:31Z

Duplicate

#0 - illuzen

2022-05-10T07:41:05Z

Debatable, are we optimizing gas for rare worst case scenario or typical case, because adding checks slows down common case.

#1 - gititGoro

2022-06-05T00:41:28Z

Gas optimizations for rare edge cases will generally be given lower scoring or ignored, especially if they obstruct the common case and especially if the UI can shield users from travelling down wasteful paths such as entering zero in the amount field.

AuditHub

A portfolio for auditors, a security profile for protocols, a hub for web3 security.

Built bymalatrax © 2024

Auditors

Browse

Contests

Browse

Get in touch

ContactTwitter