Platform: Code4rena
Start Date: 31/08/2023
Pot Size: $55,000 USDC
Total HM: 5
Participants: 30
Period: 6 days
Judge: hickuphh3
Total Solo HM: 2
Id: 282
League: ETH
Rank: 8/30
Findings: 2
Award: $1,048.07
🌟 Selected for report: 0
🚀 Solo Findings: 0
🌟 Selected for report: ADM
Also found by: HChang26, rvierdiiev, twicek
695.6101 USDC - $695.61
Judge has assessed an item in Issue #86 as 2 risk. The relevant finding follows:
QA-02. BondingManager.withdrawFees doesn’t create checkpoint
#0 - c4-judge
2023-09-20T10:33:37Z
HickupHH3 marked the issue as duplicate of #104
#1 - c4-judge
2023-09-20T10:33:41Z
HickupHH3 marked the issue as satisfactory
🌟 Selected for report: Proxy
Also found by: Banditx0x, DavidGiladi, favelanky, ladboy233, nadin, rvierdiiev
352.4605 USDC - $352.46
reward then delegators lose rewards.In order to distribute rewards among delegators, transcoder should call reward function for each period.
In case if he decides to fully unbond without calling reward function, then delegators will not receive rewards for that period.
When unbond transcoder, check that his last lastRewardRound is current round, or call reward.
When withdrawFees function is called, then autoClaimEarnings modifier is used, which will update user's staked amount according to the earned rewards.
As bonded amount has changed, that means that new checkpoint should be created, but withdrawFees function doesn't do that.
Create checkpoint for withdrawFees function.
When user delegate to transcoder, then he can use their votes. So amount of votes that transcoder has is delegatedAmount.
It's possible that transcoder will be slashed. Then some penalty is slashed from his balance and also he is resigned. The problem is that he still has delegatedAmount of votes that he can use for voting, while he is malicious, so can do actions against protocol.
Make resigned delegator use only bondedAmount as votes.
updateTranscoderWithFees function is called in order to distribute fee to the transcoder and his delegators. It's possible that this function will be called not in the round where job was done, but later. So it's possible that transcoder will have to unbond during that time.
Once unbonded, then it will be not possible to send fes and delegators will use their fees.
Do not know good solution.
#0 - 141345
2023-09-09T15:32:49Z
QA-02 is dup of https://github.com/code-423n4/2023-08-livepeer-findings/issues/104
QA-01 and QA-04 might need to escalate to medium
#1 - c4-pre-sort
2023-09-09T15:53:13Z
141345 marked the issue as high quality report
#2 - victorges
2023-09-15T18:33:13Z
This is the expected behavior. The transcoder has to call reward in the round to mint fees to their them and their delegators. If the transcoder is exiting the protocol, its delegators should migrate their stake to another transcoder instead.
This is a real issue which will be patched. Confirming the report for this issue.
This is the expected behavior. Inactive transcoders and their delegators still have voting power, and that includes slashed transcoders.
updateTranscoderWithFees is only called when the transcoder redeems a ticket with the TicketBroker. It is in the best interest of the transcoder to redeem those tickets as they get (sometimes most of) the pay from the tickets. If the transcoder is leaving the protocol, delegators should migrate their stake to another one.
#3 - victorges
2023-09-15T18:33:43Z
Confirming report due to issue QA-02, which is a duplicate of #104 as stated above
#4 - c4-sponsor
2023-09-15T18:33:48Z
victorges (sponsor) confirmed
#5 - HickupHH3
2023-09-18T07:38:42Z
#61: R
#6 - HickupHH3
2023-09-20T10:35:32Z
QA-01: similar to #61 (R) QA-02: upgraded QA-03: R QA-04: R #90: R #85: L
1L 4R
#7 - c4-judge
2023-09-20T10:35:37Z
HickupHH3 marked the issue as grade-b
#8 - c4-judge
2023-09-21T10:23:34Z
HickupHH3 marked the issue as grade-a
#9 - c4-judge
2023-09-22T16:10:57Z
HickupHH3 marked the issue as grade-b
#10 - c4-judge
2023-09-25T03:14:29Z
HickupHH3 marked the issue as grade-a