Arcade.xyz - rvierdiiev's results

The first of its kind Web3 platform to enable liquid lending markets for NFTs.

General Information

Platform: Code4rena

Start Date: 21/07/2023

Pot Size: $90,500 USDC

Total HM: 8

Participants: 60

Period: 7 days

Judge: 0xean

Total Solo HM: 2

Id: 264

League: ETH

Arcade.xyz

Findings Distribution

Researcher Performance

Rank: 18/60

Findings: 1

Award: $589.87

🌟 Selected for report: 0

🚀 Solo Findings: 0

Findings Information

🌟 Selected for report: Anirruth

Also found by: DadeKuma, Matin, MohammedRizwan, bart1e, giovannidisiena, ladboy233, rvierdiiev

Labels

bug
2 (Med Risk)
satisfactory
duplicate-70

Awards

589.8716 USDC - $589.87

External Links

Lines of code

https://github.com/code-423n4/2023-07-arcade/blob/main/contracts/external/council/CoreVoting.sol#L15

Vulnerability details

Impact

CoreVoting contract suppose to work on PoW. Time calculating will be wrong.

Proof of Concept

Arcade protocol is going to use CoreVoting contract for voting. As you can see, this contract was created for PoW, because it doesn't use fixed time for block creation.

As this variable is used to calculate time in the contract, that means that it will be done incorrectly.

Tools Used

Vscode

Change this contract to use 12s as block producing time.

Assessed type

Error

#0 - c4-pre-sort

2023-07-29T13:48:27Z

141345 marked the issue as duplicate of #56

#1 - c4-judge

2023-08-11T16:35:08Z

0xean marked the issue as satisfactory

#2 - c4-judge

2023-08-14T16:26:09Z

0xean changed the severity to QA (Quality Assurance)

#3 - c4-judge

2023-08-14T16:28:22Z

0xean marked the issue as grade-c

#4 - c4-judge

2023-08-16T12:34:13Z

This previously downgraded issue has been upgraded by 0xean

#5 - captainmangoC4

2023-08-16T17:03:24Z

Removing stray "unsatisfactory" label per judge's request

#6 - c4-judge

2023-08-16T20:17:07Z

0xean marked the issue as not a duplicate

#7 - c4-judge

2023-08-16T20:17:37Z

0xean marked the issue as duplicate of #56

AuditHub

A portfolio for auditors, a security profile for protocols, a hub for web3 security.

Built bymalatrax © 2024

Auditors

Browse

Contests

Browse

Get in touch

ContactTwitter