Platform: Code4rena
Start Date: 24/03/2022
Pot Size: $75,000 USDC
Total HM: 15
Participants: 59
Period: 7 days
Judge: gzeon
Id: 103
League: ETH
Rank: 19/59
Findings: 2
Award: $1,121.31
🌟 Selected for report: 0
🚀 Solo Findings: 0
🌟 Selected for report: hyh
Also found by: danb, kirk-baird, pmerkleplant
https://github.com/code-423n4/2022-03-Li.finance/blob/main/src/Facets/NXTPFacet.sol#L46
A user might accidently send ether if sendingAssetId is not ether.
add in line 54:
require(msg.value == 0);
#0 - H3xept
2022-04-11T12:48:21Z
🌟 Selected for report: hake
Also found by: Jujic, WatchPug, catchup, danb, defsec, kirk-baird, nedodn, shenwilly, sorrynotsorry
196.5762 USDC - $196.58
https://github.com/code-423n4/2022-03-Li.finance/blob/main/src/Facets/WithdrawFacet.sol#L20
admin can steal all user funds
#0 - maxklenk
2022-04-01T07:44:26Z
The contract does not hold any user funds. The withdraw function is only added to withdraw funds to the users that accidentally ended up in the contract.
#1 - gzeoneth
2022-04-16T18:03:16Z