Livepeer contest - pauliax's results

Handle

pauliax

Vulnerability details

Impact

Function recoverSigner in L1Migrator returns an empty address if the signature is empty:

  if (_sig.length == 0) {
      return address(0);
  }

This means you can bypass the signature verification by passing an empty signature and an empty address for _l1Addr. Then you can specify any _l2Addr and it will work.

Recommended Mitigation Steps

It should revert when the signature is empty or just let the ECDSA.recover reject it.

Handle

pauliax

Vulnerability details

Impact

Would be cheapier to have >= condition here to avoid extra calculation when _amount = l2SupplyFromL1:

  if (_amount > l2SupplyFromL1) {
      l2SupplyFromL1 = 0;
  } else {
      l2SupplyFromL1 -= _amount;
  }

Handle

pauliax

Vulnerability details

Impact

(initialStake - claimedInitialStake) is re-calculated twice:

  // Calculate stake owed to delegator
  uint256 currTotalStake = pendingStake();
  uint256 owedStake = (currTotalStake * _stake) /
      (initialStake - claimedInitialStake);

  // Calculate fees owed to delegator
  uint256 currTotalFees = pendingFees();
  uint256 owedFees = (currTotalFees * _stake) /
      (initialStake - claimedInitialStake);

Handle

pauliax

Vulnerability details

Impact

Assigned operations to constant variables are re-evaluated every time:

  bytes32 public constant MINTER_ROLE = keccak256("MINTER_ROLE");
  bytes32 public constant BURNER_ROLE = keccak256("BURNER_ROLE");

  bytes32 public constant GOVERNOR_ROLE = keccak256("GOVERNOR_ROLE");

  bytes32 private constant MIGRATE_DELEGATOR_TYPE_HASH =
    keccak256("MigrateDelegator(address l1Addr,address l2Addr)");

  bytes32 private constant MIGRATE_UNBONDING_LOCKS_TYPE_HASH =
    keccak256(
      "MigrateUnbondingLocks(address l1Addr,address l2Addr,uint256[] unbondingLockIds)"
    );

  bytes32 private constant MIGRATE_SENDER_TYPE_HASH =
    keccak256("MigrateSender(address l1Addr,address l2Addr)");

See https://github.com/ethereum/solidity/issues/9232

Recommended Mitigation Steps

Change from 'constant' to 'immutable'.