ParaSpace contest - datapunk's results

The First Ever Cross-Margin NFT Financialization Protocol.

General Information

Platform: Code4rena

Start Date: 28/11/2022

Pot Size: $192,500 USDC

Total HM: 33

Participants: 106

Period: 11 days

Judge: LSDan

Total Solo HM: 15

Id: 186

League: ETH

ParaSpace

Findings Distribution

Researcher Performance

Rank: 57/106

Findings: 2

Award: $126.39

QA:

grade-b

🌟 Selected for report: 0

🚀 Solo Findings: 0

External Links

Code4rena Contest Page Github Contest Repository Github Findings Repository ParaSpace

Findings Information

🌟 Selected for report: IllIllI

Also found by: 0xNazgul, Atarpara, Awesome, Aymen0909, BClabs, Kong, ali_shehab, bullseye, chaduke, csanuragjain, datapunk, fatherOfBlocks, hansfriese, kaliberpoziomka8552, nicobevi, pashov, pzeus, shark, unforgiven, web3er, xiaoming90

Awards

22.467 USDC - $22.47

Labels

bug

3 (High Risk)

partial-50

duplicate-402

External Links

Link to GitHub issue

Lines of code

https://github.com/code-423n4/2022-11-paraspace/blob/c6820a279c64a299a783955749fdc977de8f0449/paraspace-core/contracts/misc/NFTFloorOracle.sol#L167

Vulnerability details

Impact

Anyone can remove existing feeder.

Proof of Concept

Tools Used

manual

Recommended Mitigation Steps

add onlyRole(DEFAULT_ADMIN_ROLE)

function removeFeeder(address _feeder)
    external
    onlyRole(DEFAULT_ADMIN_ROLE)
    onlyWhenFeederExisted(_feeder)
{
    _removeFeeder(_feeder);
}

#0 - JeffCX
2022-12-18T04:13:44Z

duplicate of https://github.com/code-423n4/2022-11-paraspace-findings/issues/112

#1 - c4-judge
2022-12-20T16:57:50Z

dmvt marked the issue as duplicate of #31

#2 - c4-judge
2023-01-09T14:12:02Z

dmvt marked the issue as partial-50

Findings Information

🌟 Selected for report: IllIllI

Also found by: 0x4non, 0x52, 0xAgro, 0xNazgul, 0xSmartContract, 0xackermann, 9svR6w, Awesome, Aymen0909, B2, BRONZEDISC, Bnke0x0, Deekshith99, Deivitto, Diana, Dravee, HE1M, Jeiwan, Kaiziron, KingNFT, Lambda, Mukund, PaludoX0, RaymondFam, Rolezn, Sathish9098, Secureverse, SmartSek, __141345__, ahmedov, ayeslick, brgltd, cccz, ch0bu, chrisdior4, cryptonue, cryptostellar5, csanuragjain, datapunk, delfin454000, erictee, gz627, gzeon, helios, i_got_hacked, ignacio, imare, jadezti, jayphbee, joestakey, kankodu, ksk2345, ladboy233, martin, nadin, nicobevi, oyc_109, pashov, pavankv, pedr02b2, pzeus, rbserver, ronnyx2017, rvierdiiev, shark, unforgiven, xiaoming90, yjrwkk

Awards

103.9175 USDC - $103.92

Labels

bug

grade-b

QA (Quality Assurance)

Q-07

External Links

Link to GitHub issue

Q1. apply modifier `onlyWhenAssetExisted(_asset)` and `onlyWhenFeederExisted(_feeder)` twice to the same function

    function removeAsset(address _asset)
        external
        onlyRole(DEFAULT_ADMIN_ROLE)
        onlyWhenAssetExisted(_asset)
    {
        _removeAsset(_asset);
    }
    function _removeAsset(address _asset)
        internal
        onlyWhenAssetExisted(_asset) {...}

https://github.com/code-423n4/2022-11-paraspace/blob/c6820a279c64a299a783955749fdc977de8f0449/paraspace-core/contracts/misc/NFTFloorOracle.sol#L148 https://github.com/code-423n4/2022-11-paraspace/blob/c6820a279c64a299a783955749fdc977de8f0449/paraspace-core/contracts/misc/NFTFloorOracle.sol#L296

function removeFeeder(address _feeder)
    external
    onlyWhenFeederExisted(_feeder)
{
    _removeFeeder(_feeder);
}
function _removeFeeder(address _feeder)
    internal
    onlyWhenFeederExisted(_feeder)

https://github.com/code-423n4/2022-11-paraspace/blob/c6820a279c64a299a783955749fdc977de8f0449/paraspace-core/contracts/misc/NFTFloorOracle.sol#L169 https://github.com/code-423n4/2022-11-paraspace/blob/c6820a279c64a299a783955749fdc977de8f0449/paraspace-core/contracts/misc/NFTFloorOracle.sol#L326

#0 - c4-judge
2023-01-25T10:53:30Z

dmvt marked the issue as grade-b

ParaSpace contest - datapunk's results

The First Ever Cross-Margin NFT Financialization Protocol.

General Information

Findings Distribution

Researcher Performance

External Links

[H-04] missing access control for `removeFeeder` - $22.47

Findings Information

Awards

Labels

External Links

Lines of code

Vulnerability details

Impact

Proof of Concept

Tools Used

Recommended Mitigation Steps

#0 - JeffCX2022-12-18T04:13:44Z

#1 - c4-judge2022-12-20T16:57:50Z

#2 - c4-judge2023-01-09T14:12:02Z

[Q-07] QA Report - $103.92

Findings Information

Awards

Labels

External Links

Q1. apply modifier onlyWhenAssetExisted(_asset) and onlyWhenFeederExisted(_feeder) twice to the same function

#0 - c4-judge2023-01-25T10:53:30Z

#0 - JeffCX
2022-12-18T04:13:44Z

#1 - c4-judge
2022-12-20T16:57:50Z

#2 - c4-judge
2023-01-09T14:12:02Z

Q1. apply modifier `onlyWhenAssetExisted(_asset)` and `onlyWhenFeederExisted(_feeder)` twice to the same function

#0 - c4-judge
2023-01-25T10:53:30Z