Holograph contest - imare's results

Lines of code

https://github.com/code-423n4/2022-10-holograph/blob/f8c2eae866280a1acfdc8a8352401ed031be1373/src/HolographOperator.sol#L275-L279

Vulnerability details

Based on the documentation provided an operator is slashed if they fail to complete a job like this:

Looking at the code where slashing happens the amount is linearly decreasing with a fixed amount (with the pod base fee) that is only defined by the chosen pod number

    uint256 amount = _getBaseBondAmount(pod);
    /**
        * @dev select operator that failed to do the job, is slashed the pod base fee
        */
    _bondedAmounts[job.operator] -= amount;

The pod base fee calculation will not change during the operator slashing:

  /**
   * @dev Internal function used for calculating the base bonding amount for a pod
   */
  function _getBaseBondAmount(uint256 pod) private view returns (uint256) {
    return (_podMultiplier**pod) * _baseBondAmount;
  }

If it happens that the chosen operator has bonded with just the base bond amount it will be removed from the pod on the first fail which is not as described on the 5/fifth fail.

Impact

Operator can be removed from the pod prior to five slashes

Proof of Concept

https://github.com/code-423n4/2022-10-holograph/blob/f8c2eae866280a1acfdc8a8352401ed031be1373/src/HolographOperator.sol#L275-L279

Tools Used

Manual review

Recommended Mitigation Steps

Introduce a slash count mapping per operator. When the job fails increment that and do the math accordingly.

[L01] ecrecover() allows malleable signatures

https://github.com/code-423n4/2022-10-holograph/blob/f8c2eae866280a1acfdc8a8352401ed031be1373/src/HolographFactory.sol#L234-L235

Best practice is to use OpenZeppelin’s ECDSA contract rather than calling ecrecover() directly

[N01] Typo in PA1D

https://github.com/code-423n4/2022-10-holograph/blob/f8c2eae866280a1acfdc8a8352401ed031be1373/src/enforcer/PA1D.sol#L378

[N02] Don't use magic numbers use constants instead

https://github.com/code-423n4/2022-10-holograph/blob/f8c2eae866280a1acfdc8a8352401ed031be1373/src/HolographOperator.sol#L259

 if (timeDifference < 6) {
          uint256 podIndex = uint256(job.fallbackOperators[timeDifference - 1]);