LI.FI contest - cthulhu_cult's results

Bridge & DEX Aggregation.

General Information

Platform: Code4rena

Start Date: 24/03/2022

Pot Size: $75,000 USDC

Total HM: 15

Participants: 59

Period: 7 days

Judge: gzeon

Id: 103

League: ETH

LI.FI

Findings Distribution

Researcher Performance

Rank: 52/59

Findings: 1

Award: $113.58

🌟 Selected for report: 0

🚀 Solo Findings: 0

Awards

113.5781 USDC - $113.58

Labels

bug
resolved
QA (Quality Assurance)

External Links

Vulnerability details

Explicit Compiler Version Not Stated

Impact

Low

Proof of Concept

An outdated version of Solidity containing known vulnerabilities could be used to compile the smart contract:

https://github.com/code-423n4/2022-03-lifinance/blob/699c2305fcfb6fe8862b75b26d1d8a2f46a551e6/src/Facets/WithdrawFacet.sol#L2

Remove the caret from the pragma directive.

Vulnerability details

Vulnerable "transfer()" Function in Use

Impact

Low

Proof of Concept

The WithdrawFacet.sol contract is using transfer() which is considered insecure as this function has a fixed gas price.

https://github.com/code-423n4/2022-03-lifinance/blob/699c2305fcfb6fe8862b75b26d1d8a2f46a551e6/src/Facets/WithdrawFacet.sol#L31

Use call() alongside ReentrancyGuard rather than the transfer() function.

#0 - H3xept

2022-04-04T08:29:04Z

  1. Will be tackled after completing the audit analysis.
  2. Fixed in lifinance/lifi-contracts@274a41b047b3863d9ae232eefea04896dc32d853 (Duplicate of #14)
AuditHub

A portfolio for auditors, a security profile for protocols, a hub for web3 security.

Built bymalatrax © 2024

Auditors

Browse

Contests

Browse

Get in touch

ContactTwitter