SIZE contest - djxploit's results

Lines of code

https://github.com/code-423n4/2022-11-size/blob/main/src/SizeSealed.sol#L163

Vulnerability details

Impact

In bid function, the safetransferfrom function doesn't check the existence of code at the token address. This is a known issue while using solmate's libraries. Hence this may lead to miscalculation of funds and may lead to loss of funds , because if safetransferfrom() is called on a token address that doesn't have contract in it, it will always return success, bypassing the return value check. Due to this protocol will think that funds has been transferred and successful , and records will be accordingly calculated, but in reality funds were never transferred. So this will lead to miscalculation and possibly loss of funds

Proof of Concept

https://github.com/code-423n4/2022-11-size/blob/main/src/SizeSealed.sol#L163

Tools Used

Manual review

Recommended Mitigation Steps

As implemented for baseToken in createAuction function, same implementation will also resolve the above issue. Also instead of that, you could use Openzeppelin's library.

1) Use indexed keyword in events

https://github.com/code-423n4/2022-11-size/blob/main/src/interfaces/ISizeSealed.sol#L114 https://github.com/code-423n4/2022-11-size/blob/main/src/interfaces/ISizeSealed.sol#L116 https://github.com/code-423n4/2022-11-size/blob/main/src/interfaces/ISizeSealed.sol#L118 https://github.com/code-423n4/2022-11-size/blob/main/src/interfaces/ISizeSealed.sol#L120 https://github.com/code-423n4/2022-11-size/blob/main/src/interfaces/ISizeSealed.sol#L122

2) Usage of uint , whose size is less than 256 bits incurs overhead

https://github.com/code-423n4/2022-11-size/blob/main/src/SizeSealed.sol#L205-L206 https://github.com/code-423n4/2022-11-size/blob/main/src/SizeSealed.sol#L217 https://github.com/code-423n4/2022-11-size/blob/main/src/SizeSealed.sol#L365 https://github.com/code-423n4/2022-11-size/blob/main/src/SizeSealed.sol#L451

3) Usage of block.timestamp is risky

https://github.com/code-423n4/2022-11-size/blob/main/src/SizeSealed.sol#L31 https://github.com/code-423n4/2022-11-size/blob/main/src/SizeSealed.sol#L35 https://github.com/code-423n4/2022-11-size/blob/main/src/SizeSealed.sol#L60 https://github.com/code-423n4/2022-11-size/blob/main/src/SizeSealed.sol#L425 https://github.com/code-423n4/2022-11-size/blob/main/src/SizeSealed.sol#L426

4) Typos should be avoided

https://github.com/code-423n4/2022-11-size/blob/main/src/SizeSealed.sol#L112 - running https://github.com/code-423n4/2022-11-size/blob/main/src/SizeSealed.sol#L431 - further

5) Use non-reentrant modifier to prevent re-entrancy

On functions like withdraw and refund , non-reentrant modifier should be used. https://github.com/code-423n4/2022-11-size/blob/main/src/SizeSealed.sol#L358 https://github.com/code-423n4/2022-11-size/blob/main/src/SizeSealed.sol#L336

1) unchecked keyword should be used on situations where there is no possibility of overflow/underflow to save gas

https://github.com/code-423n4/2022-11-size/blob/main/src/util/CommonTokenMath.sol#L65

2) Use calldata instead of memory on external function to save gas

https://github.com/code-423n4/2022-11-size/blob/main/src/util/ECCMath.sol#L37 https://github.com/code-423n4/2022-11-size/blob/main/src/util/ECCMath.sol#L51 https://github.com/code-423n4/2022-11-size/blob/main/src/util/ECCMath.sol#L60 https://github.com/code-423n4/2022-11-size/blob/main/src/util/ECCMath.sol#L25

3) Avoid redundant return statements to save gas

https://github.com/code-423n4/2022-11-size/blob/main/src/util/ECCMath.sol#L56 https://github.com/code-423n4/2022-11-size/blob/main/src/SizeSealed.sol#L454

4) Cache storage variable, used consecutively to save gas

Here a.params.merkleRoot can be cached https://github.com/code-423n4/2022-11-size/blob/main/src/SizeSealed.sol#L132 https://github.com/code-423n4/2022-11-size/blob/main/src/SizeSealed.sol#L134

https://github.com/code-423n4/2022-11-size/blob/main/src/SizeSealed.sol#L29-L37 : Here a.timings can be cached to save the key caclulation gas cost

5) Use break instead of revert inside loop statements to save gas

https://github.com/code-423n4/2022-11-size/blob/main/src/SizeSealed.sol#L304 https://github.com/code-423n4/2022-11-size/blob/main/src/SizeSealed.sol#L275 https://github.com/code-423n4/2022-11-size/blob/main/src/SizeSealed.sol#L298 https://github.com/code-423n4/2022-11-size/blob/main/src/SizeSealed.sol#L310 https://github.com/code-423n4/2022-11-size/blob/main/src/SizeSealed.sol#L314