Escher contest - mahdikarimi's results

A decentralized curated marketplace for editioned artwork.

General Information

Platform: Code4rena

Start Date: 06/12/2022

Pot Size: $36,500 USDC

Total HM: 16

Participants: 119

Period: 3 days

Judge: berndartmueller

Total Solo HM: 2

Id: 189

League: ETH

Escher

Findings Distribution

Researcher Performance

Rank: 92/119

Findings: 2

Award: $1.76

🌟 Selected for report: 0

🚀 Solo Findings: 0

Lines of code

https://github.com/code-423n4/2022-12-escher/blob/5d8be6aa0e8634fdb2f328b99076b0d05fefab73/src/minters/LPDA.sol#L124

Vulnerability details

Impact

It's possible to getPrice function not be able return value ( due to underflow wich makes transaction revert )

Proof of Concept

temp.startPrice - (temp.dropPerSecond * timeElapsed) In this line If the timeElapsed and dropPerSecond be larger that startPrice makes it impossible to return value .

Tools Used

add a check when createLPDASale to ensure that ( startPrice - ( endTime - startTime ) * dropPerSecond ) can not be negative .

#0 - c4-judge

2022-12-11T11:38:46Z

berndartmueller marked the issue as duplicate of #392

#1 - c4-judge

2023-01-02T19:55:55Z

berndartmueller changed the severity to 3 (High Risk)

#2 - c4-judge

2023-01-02T19:56:00Z

berndartmueller marked the issue as partial-50

Awards

1.3417 USDC - $1.34

Labels

bug
2 (Med Risk)
downgraded by judge
satisfactory
duplicate-328

External Links

Lines of code

https://github.com/code-423n4/2022-12-escher/blob/5d8be6aa0e8634fdb2f328b99076b0d05fefab73/src/minters/LPDA.sol#L81-L88

Vulnerability details

Impact

fee amount will not transfer to feeReceiver in case of auction ends and not all editions being sold .

Proof of Concept

In LPDA sale the only mechanism to transfer fee amount to feeReceiver is when the newId is equal to finalId it means if after auction endtime newId not achieves finalId ( not all tokens being sold ) the value will be lock down and no way to transfer feeAmount to feeReceiver .

Tools Used

Manual Review

Add a seperate function that transfers automatically all the fee amount to feeReceiver at the end of auction . Note : you need to ensure that adding this mechanism doesn't effect the other transfer mechanism for example add a safety check or modifier to ensure this can be called only if all tokens not being sold ( It means only if other mechanism doesn't performs ) .

#0 - c4-judge

2022-12-12T09:00:43Z

berndartmueller marked the issue as duplicate of #328

#1 - c4-judge

2023-01-02T20:20:56Z

berndartmueller changed the severity to 2 (Med Risk)

#2 - c4-judge

2023-01-02T20:22:47Z

berndartmueller marked the issue as satisfactory

AuditHub

A portfolio for auditors, a security profile for protocols, a hub for web3 security.

Built bymalatrax © 2024

Auditors

Browse

Contests

Browse

Get in touch

ContactTwitter