SIZE contest - pashov's results

An on-chain sealed bid auction protocol.

General Information

Platform: Code4rena

Start Date: 04/11/2022

Pot Size: $42,500 USDC

Total HM: 9

Participants: 88

Period: 4 days

Judge: 0xean

Total Solo HM: 2

Id: 180

League: ETH

SIZE

Findings Distribution

Researcher Performance

Rank: 81/88

Findings: 1

Award: $8.54

🌟 Selected for report: 0

πŸš€ Solo Findings: 0

Awards

8.5414 USDC - $8.54

Labels

bug
2 (Med Risk)
satisfactory
duplicate-47

External Links

Lines of code

https://github.com/code-423n4/2022-11-size/blob/fec5a6148e9c08518465a04c08f1f3e9908eb5a8/src/SizeSealed.sol#L55

Vulnerability details

Proof of Concept

Some tokens may make arbitrary balance modifications outside of transfers (e.g. Ampleforth style rebasing tokens, Compound style airdrops of governance tokens, mintable / burnable tokens). If such a token as used, since in the protocol we cache the auction total amount and bid quote amounts, if later the token balances are rebased it can result in leftover tokens stuck in contract or in the worst case in a DoS by a revert, since there will be less balance than what was cached.

Impact

The impact is potentially a loss of value or a permanent revert in the protocol when using a rebasing token

Recommendation

Add a whitelist to allow only a set of tokens, not rebasing ones, or add it to the project docs

#0 - c4-judge

2022-11-10T01:13:05Z

0xean marked the issue as duplicate

#1 - c4-judge

2022-12-06T00:22:02Z

0xean marked the issue as satisfactory

AuditHub

A portfolio for auditors, a security profile for protocols, a hub for web3 security.

Built bymalatrax Β© 2024

Auditors

Browse

Contests

Browse

Get in touch

ContactTwitter