Platform: Code4rena
Start Date: 03/07/2023
Pot Size: $100,000 USDC
Total HM: 4
Participants: 36
Period: 10 days
Judge: gzeon
Total Solo HM: 3
Id: 257
League: ETH
Rank: 12/36
Findings: 1
Award: $610.77
š Selected for report: 0
š Solo Findings: 0
š Selected for report: shark
Also found by: 0xMilenov, Bauchibred, Kaysoft, MohammedRizwan, codegpt, descharre, fatherOfBlocks, ihtishamsudo, klau5, koxuan, nadin
610.775 USDC - $610.77
script/ProposeTimelockMigrationCleanupMainnet.s.sol
script/ProposeDAOV3UpgradeMainnet.s.sol
L6/7 - Two contracts are imported, but they are never used, therefore they generate more gas expense in the deploy and also generate a low understanding in the blockchain explorer.
L49 - The console.log should be removed as it reduces the readability of the code.
script/DeployDAOV3NewContractsBase.s.sol
script/ProposeENSReverseLookupConfigMainnet.s.sol
script/ProposeDAOV3UpgradeTestnet.s.sol
L6/7 - Two contracts are imported, but they are never used, therefore they generate more gas expense in the deploy and also generate a low understanding in the blockchain explorer.
L19 - No validation is performed in the constructor and the variables are immutable, therefore they should be validated before setting the variable to != 0.
L57 - The console.log should be removed as it reduces the readability of the code.
script/DeployDAOV3DataContractsBase.s.sol
contracts/governance/NounsDAOLogicV2.sol
L55/77 - The entire NounsDAOInterfaces.sol file is imported, being that only NounsDAOStorageV2 and NounsDAOEventsV2 are used, the simplest and easiest to understand is to directly import the contracts that are used.
L55/57 - The file NounsDAOInterfaces.sol contains multiple contracts that are not interfaces, this can cause confusion as it does not respect standards.
L150/154/158/170/171/172/644/662/681 - The initialize() function duplicates validation logic that exists in setter functions for the variables: votingPeriod, votingDelay and proposalThresholdBPS. The most beneficial thing would be to use the setters directly, inside the initialize().
L598 - abi.encodePacked() should not be used with dynamic types when passing the result to a hash function such as keccak256() Use abi.encode() instead which will pad items to 32 bytes, which will prevent hash collisions (e.g. abi.encodePacked(0x123,0x456) => 0x123456 => abi.encodePacked(0x1,0x23456), but abi.encode(0x123,0x456) => 0x0...1230...456). āUnless there is a compelling reason, abi.encode should be preferredā. If there is only one argument to abi.encodePacked() it can often be cast to bytes() or bytes32() instead. If all arguments are strings and or bytes, bytes.concat() should be used instead.
contracts/governance/NounsDAOProxy.sol
contracts/governance/fork/ForkDAODeployer.sol
L21/25 - The NounsDAOStorageV3 and NounsDAOProxy contracts are imported, but they are never used, therefore they generate more gas expense in the deploy and also generate a low understanding in the blockchain explorer.
L61 - No validation is performed in the constructor and the variables are immutable, therefore they should be validated before setting the variable to != 0.
contracts/governance/fork/NounsDAOV3Fork.sol
contracts/governance/fork/NounsDAOForkEscrow.sol
contracts/governance/fork/newdao/governance/NounsDAOEventsFork.sol
contracts/governance/fork/newdao/governance/NounsDAOLogicV1Fork.sol
contracts/governance/fork/newdao/token/base/ERC721CheckpointableUpgradeable.sol
contracts/governance/NounsDAOLogicV3.sol
contracts/governance/NounsDAOV3Votes.sol
contracts/governance/NounsDAOInterfaces.sol
contracts/governance/NounsDAOV3Proposals.sol
contracts/governance/NounsDAOV3DynamicQuorum.sol
#0 - c4-judge
2023-07-25T10:06:01Z
gzeon-c4 marked the issue as grade-a