Kuiper contest - joeysantoro's results

Handle

joeysantoro

Vulnerability details

Impact

If any of the timelocked variables of a basket are pending a change, a transaction to change the target will revert during the timelock window.

Proof of Concept

Publisher wants to change license fee. They submit a change request but fat finger with the wrong value. The only way to change the pending licenseFee is to complete the change to the incorrect value (after timelock period) then resubmit a new request.

In the case of changing index this can be mitigated by using deleteNewIndex(), however changePublisher and changeLicenseFee cannot be mitigated.

Recommended Mitigation Steps

Introduce a "setPendingX" method for each of liscenceFee, publisher, and index. This cleanly separates the logic and allows for overwrite of pending during timelock window.

Handle

joeysantoro

Vulnerability details

Impact

Enforces fees go to DAO/Factory owner address exclusively. If the DAO owner is ever revoked for decentralization reasons, the handleFees() method would revert when attempting to mint.

Proof of Concept

handleFees() uses the owner of Factory. If owner is changed to address(0), the fees would minter to 0 address. However OpenZeppelin ERC20 library reverts if tokens are transferred or minted to the 0 address.

Recommended Mitigation Steps

Add a feeTo public address in the factory used for sending fees, configurable by governance.

Handle

joeysantoro

Vulnerability details

Impact

Basket.validateWeights does a nested for loop to check uniqueness of tokens, increasing gas costs

Recommended Mitigation Steps

If you add a line checking the tokens are provided in sorted order with a strict inequality, this would enforce uniqueness without the nested loop. Likewise you can move the check != address(0) outside the main loop to further save gas