Cudos contest - shenwilly's results

Low Risk Vulnerabilities

1. Inaccurate comments

submitBatch and updateValset states that "anyone can call this function", but there's a check inside that requires sender to be orchestrator.

Mitigation

Modify the comment to "any orchestrator".

2. verifySig doesn't check for zero address

ecrecover returns address zero when it throws error. Anyone can submit address zero as the value of _signer and a fake signature in verifySig and it would return true.

It is unlikely that there will be a validator with address zero. However, if there is, a malicious orchestrator can take advantage of it to stage an attack with reduced cost (as the address zero validator's power can be used by anyone).

Mitigation

Add a check to prevent address zero input before L185.

require(_signer != address(0));

3. Missing zero address check

In the constructor there's no zero address check for _validators. A faulty deployment script could include a zero address which reduces the cost of attack by malicious actors when combined with vulnerability #2 described above.

Mitigation

Iterate over _validators to make sure there is no address zero.