Basin - ginlee's results

A composable EVM-native decentralized exchange protocol.

General Information

Platform: Code4rena

Start Date: 03/07/2023

Pot Size: $40,000 USDC

Total HM: 14

Participants: 74

Period: 7 days

Judge: alcueca

Total Solo HM: 9

Id: 259

League: ETH

Basin

Findings Distribution

Researcher Performance

Rank: 52/74

Findings: 1

Award: $17.52

QA:
grade-a

🌟 Selected for report: 0

🚀 Solo Findings: 0

Lines of code

https://github.com/code-423n4/2023-07-basin/blob/c1b72d4e372a6246e0efbd57b47fb4cbb5d77062/src/pumps/MultiFlowPump.sol#L113

Vulnerability details

Impact

If deltaTimestamp is less than BLOCK_TIME, blocksPassed will round down to zero which lead to wrong calculation in many places

Proof of Concept

https://github.com/code-423n4/2023-07-basin/blob/c1b72d4e372a6246e0efbd57b47fb4cbb5d77062/src/pumps/MultiFlowPump.sol#L113

Tools Used

Manual Review

Always consider if your computation may round down to zero, especially when using small numbers, and if so whether your code should revert

if( blocksPassed == 0 ) { revert("Round down to zero"); }

Assessed type

Math

#0 - c4-pre-sort

2023-07-13T08:56:52Z

141345 marked the issue as duplicate of #287

#1 - 141345

2023-07-13T08:58:40Z

lack details on the impact and potential loss

#2 - c4-judge

2023-08-05T21:25:37Z

alcueca marked the issue as not a duplicate

#3 - c4-judge

2023-08-05T21:25:40Z

alcueca changed the severity to QA (Quality Assurance)

#4 - c4-judge

2023-08-05T21:25:45Z

alcueca marked the issue as grade-a

#5 - alcueca

2023-08-05T21:26:06Z

No proof of any impact, but worth it as QA

AuditHub

A portfolio for auditors, a security profile for protocols, a hub for web3 security.

Built bymalatrax © 2024

Auditors

Browse

Contests

Browse

Get in touch

ContactTwitter