Debt DAO contest - merlin's results

A cryptonative credit marketplace for fully anon and trustless loans to DAOs.

General Information

Platform: Code4rena

Start Date: 03/11/2022

Pot Size: $115,500 USDC

Total HM: 17

Participants: 120

Period: 7 days

Judge: LSDan

Total Solo HM: 1

Id: 174

League: ETH

Debt DAO

Findings Distribution

Researcher Performance

Rank: 71/120

Findings: 2

Award: $66.69

QA:
grade-b

🌟 Selected for report: 0

🚀 Solo Findings: 0

Awards

5.3388 USDC - $5.34

Labels

bug
2 (Med Risk)
satisfactory
duplicate-369

External Links

Lines of code

https://github.com/debtdao/Line-of-Credit/blob/e8aa08b44f6132a5ed901f8daa231700c5afeb3a/contracts/utils/LineLib.sol#L48

Vulnerability details

Impact

The transfer() function forward a fixed amount of 2300 gas. Historically, it has often been recommended to use these functions for value transfers to guard against reentrancy attacks. However, the gas cost of EVM instructions may change significantly during hard forks which may break already deployed contract systems that make fixed assumptions about gas costs. For example. EIP 1884 broke several existing smart contracts due to a cost increase of the SLOAD instruction.

Proof of Concept

The LineLib library has a function sendOutTokenOrETH that sends ETH or ERC20 tokens to an external contract. The transfer() function is used to send ETH: https://github.com/debtdao/Line-of-Credit/blob/e8aa08b44f6132a5ed901f8daa231700c5afeb3a/contracts/utils/LineLib.sol#L48

Tools Used

Slither, the Solidity source analyzer

Avoid the use of transfer() and do not otherwise specify a fixed amount of gas when performing calls. Use .call.value(...)("") instead.

#0 - c4-judge

2022-11-17T12:09:15Z

dmvt marked the issue as duplicate of #14

#1 - c4-judge

2022-11-17T19:18:58Z

dmvt marked the issue as partial-50

#2 - c4-judge

2022-12-06T14:51:44Z

dmvt marked the issue as full credit

#3 - c4-judge

2022-12-06T14:51:48Z

dmvt marked the issue as satisfactory

#4 - C4-Staff

2022-12-20T05:56:43Z

liveactionllama marked the issue as duplicate of #369

Issue 1

Title

Unreachable code

https://github.com/debtdao/Line-of-Credit/blob/e8aa08b44f6132a5ed901f8daa231700c5afeb3a/contracts/utils/SpigotedLineLib.sol#L207 https://github.com/debtdao/Line-of-Credit/blob/e8aa08b44f6132a5ed901f8daa231700c5afeb3a/contracts/utils/SpigotedLineLib.sol#L234

Impact

The SpigotedLineLib library has releaseSpigot() and sweep() functions that has a part of the code which can never be executed. (return false;)

Tools Used

Slither, the Solidity source analyzer

Consider removing the useless code.

Issue 2

Title

SPDX license identifier not provided smart contracts

Impact

All contracts do not have SPDX license identifier.

Tools Used

Slither, the Solidity source analyzer

Consider adding SPDX license identifier to all smart contracts.

#0 - c4-judge

2022-12-06T22:06:04Z

dmvt marked the issue as grade-b

AuditHub

A portfolio for auditors, a security profile for protocols, a hub for web3 security.

Built bymalatrax © 2024

Auditors

Browse

Contests

Browse

Get in touch

ContactTwitter