Platform: Code4rena
Start Date: 14/04/2022
Pot Size: $75,000 USDC
Total HM: 8
Participants: 72
Period: 7 days
Judge: Jack the Pug
Total Solo HM: 2
Id: 110
League: ETH
Rank: 2/72
Findings: 3
Award: $9,003.30
🌟 Selected for report: 1
🚀 Solo Findings: 1
🌟 Selected for report: cccz
Also found by: 0xBug, 0xDjango, CertoraInc, TrungOre, VAD37, berndartmueller, georgypetrov, horsefacts, m9800, pedroais, rayn, reassor, scaraven, wuwe1
431.1404 USDC - $431.14
https://github.com/code-423n4/2022-04-badger-citadel/blob/main/src/StakedCitadel.sol#L830 https://github.com/code-423n4/2022-04-badger-citadel/blob/main/src/StakedCitadelVester.sol#L132
Breaks staking withdraw
Vester contract doesn't have setupVesting function
should be vest
#0 - GalloDaSballo
2022-04-23T01:49:18Z
Agree
#1 - jack-the-pug
2022-06-05T06:54:47Z
Dup #9
🌟 Selected for report: georgypetrov
8480.7862 USDC - $8,480.79
https://github.com/code-423n4/2022-04-badger-citadel/blob/main/src/CitadelMinter.sol#L217
User can sandwich mintAndDistribute function if mintable is high enough
mintAndDistribute increase a price of staking share, that allows to withdraw more than deposited.
user takes part of distributed citadels, so different users have smaller profit from distribution
Call mintAndDistribute through flashbots
#0 - GalloDaSballo
2022-04-23T01:45:45Z
My interpretation of the finding is that there's no linear vesting in the way more rewards are distributed so they can be frontrun.
I have to disagree in that taking 21 days of exposure to a random token in order to gain a small sub 1% gain is probably not what I'd call a smart move.
That said, I believe the front-running finding to be valid, and while I disagree with High I believe the finding to have validity
#1 - jack-the-pug
2022-05-29T06:27:27Z
Downgrading to Medium as this attack vector is not economically profitable in practice (because of the 21 days vesting).
🌟 Selected for report: IllIllI
Also found by: 0v3rf10w, 0x1f8b, 0xDjango, 0xkatana, AmitN, CertoraInc, Dravee, Funen, Hawkeye, Jujic, MaratCerby, Picodes, Ruhum, SolidityScan, TerrierLover, TomFrenchBlockchain, TrungOre, VAD37, Yiko, berndartmueller, cmichel, csanuragjain, danb, defsec, delfin454000, dipp, ellahi, fatherOfBlocks, georgypetrov, gs8nrv, gzeon, horsefacts, hubble, hyh, ilan, jah, joestakey, kebabsec, kenta, kyliek, m9800, minhquanym, oyc_109, p_crypt0, peritoflores, rayn, reassor, remora, rfa, robee, scaraven, securerodd, shenwilly, sorrynotsorry, tchkvsky, teryanarmen, z3s
91.3652 USDC - $91.37
https://github.com/code-423n4/2022-04-badger-citadel/blob/main/src/CitadelMinter.sol#L228 https://github.com/code-423n4/2022-04-badger-citadel/blob/main/src/CitadelMinter.sol#L348
Dust from mintable remains undistributed
Due to rounding (mintable * part_bps / MAX_BPS) part of mintable remains on contract https://github.com/code-423n4/2022-04-badger-citadel/blob/main/src/CitadelMinter.sol#L228 https://github.com/code-423n4/2022-04-badger-citadel/blob/main/src/CitadelMinter.sol#L348 There is no sweeping to save it
To calculate fundingAmount subtract from mintable locking and staking amounts and for the last funding pool also sub
#0 - GalloDaSballo
2022-04-23T01:43:24Z
By definition the "loss" will always be in the contract, the dust over time will cycle (if you check for the specific grain of sand) you'll see that they leave as they reach a value that is above MAX_BPS
For that reason I believe the finding to be valid but it's impact is literally MAX_BPS - 1 wei of tokens per time the math is ran so I believe non-critical to be more accurate