veRWA - devival's results

Incentivization Primitive for Real World Assets on Canto

General Information

Platform: Code4rena

Start Date: 07/08/2023

Pot Size: $36,500 USDC

Total HM: 11

Participants: 125

Period: 3 days

Judge: alcueca

Total Solo HM: 4

Id: 274

League: ETH

Canto

Findings Distribution

Researcher Performance

Rank: 113/125

Findings: 1

Award: $4.23

QA:
grade-b

🌟 Selected for report: 0

🚀 Solo Findings: 0

Unnecessary nonReentrant modifier in the createLock function of VotingEscrow.sol contract

function createLock(uint256 _value) external payable nonReentrant {

VotingEscrow.sol#L268 The modifier was necessary in the FIAT DAO codebase but in this setup, it should not be as it follows the Check-Effects-Interactions pattern.

Wrong comments in the whiteListLendingMarket function of LendingLedger.sol contract

whiteListLendingMarket function in the LendingLedger.sol contract allows both whitelisting a lending market and delisting it from the whitelist by submitting true or false in the _isWhiteListed parameter.

/// @notice Used by governance to whitelist a lending market /// @param _market Address of the market to whitelist /// @param _isWhiteListed Whether the market is whitelisted or not

LendingLedger.sol#L201 Recommendation: Please edit the comments accordingly. For instance, replace the first line of comments with "/// @notice Used by governance to assign or remove whitelist status to a lending market"

Missing checks for address(0) in add_gauge function of GaugeController.sol contract

function add_gauge(address _gauge) external onlyGovernance { require(!isValidGauge[_gauge], "Gauge already exists"); isValidGauge[_gauge] = true; emit NewGauge(_gauge); }

GaugeController.sol#L118 Recommendation: add a check for address(0) at the beginning of the add_gauge function. Example: require(!address(0), "Zero address");

#0 - c4-judge

2023-08-22T13:57:19Z

alcueca marked the issue as grade-b

AuditHub

A portfolio for auditors, a security profile for protocols, a hub for web3 security.

Built bymalatrax © 2024

Auditors

Browse

Contests

Browse

Get in touch

ContactTwitter