Rigor Protocol contest - joestakey's results

QA Report

Table of Contents

Low

• Can submit a project with no budget
• totalLent mismatch across contracts
• Wrong revert condition comment

summary

Can submit a project with no budget

IMPACT

According to the documentation:

Note that you cannot submit a project with no total budget. Therefore it requires at least one task with a budget > 0

It is however possible to call Community.publishProject() for a project with no budget

SEVERITY

Low

PROOF OF CONCEPT

Community.sol

In publishProject(), there is no check that the project in question has a budget or tasks added to it.

TOOLS USED

Manual Analysis

MITIGATION

Add the following line to publishProject():

require(_projectInstance.projectCost() > 0, "Community:project has no total budget");

totalLent mismatch across contracts

PROBLEM

There is a mismatch across contracts between the totalLent variables keeping track of the total amount lent to a project:

• in Community.sol, _communities[_communityID].projectDetails[_project].totalLent does not take into account Project.totalLent. This does not lead to any loss of funds as there are checks in Project.sol, but this can be misleading for anyone calling Community.projectDetails, as the _communityProject.totalLent return value may not match Project.totalLent, ie the real amount lent to a project.

TOOLS USED

Manual Analysis

MITIGATION

421:         _communities[_communityID]
422:             .projectDetails[_project]
-423:             .totalLent += _amountToProject;
+423:             .totalLent = _projectInstance.totalLent()+ _amountToProject;

Wrong revert condition comment

IMPACT

The comment describing the revert condition of the first check in Project.lendToProject does not exactly match the revert condition

SEVERITY

Low

PROOF OF CONCEPT

For two conditions A and B, there is the equivalence:

!(!A || B) <=> (A && !B)

We can hence rewrite this require statement as:

if (restrictedToAdmin && _sender != homeFi.admin()

which reverts if the community creation is paused and sender is not HomeFi admin.

The former comment is a bit misleading because the or makes it sound as if only the homeFi admin can call createCommunity().

TOOLS USED

Manual Analysis

MITIGATION

-// Revert if community creation is paused or sender is not HomeFi admin
+// Revert if community creation is paused and sender is not HomeFi admin