Nouns DAO contest - sikorico's results

A DAO-driven NFT project on Ethereum.

General Information

Platform: Code4rena

Start Date: 22/08/2022

Pot Size: $50,000 USDC

Total HM: 4

Participants: 160

Period: 5 days

Judge: gzeon

Total Solo HM: 2

Id: 155

League: ETH

Nouns DAO

Findings Distribution

Researcher Performance

Rank: 45/160

Findings: 2

Award: $52.36

🌟 Selected for report: 0

🚀 Solo Findings: 0

External Links

Code4rena Contest Page Github Contest Repository Github Findings Repository Nouns DAO

Findings Information

🌟 Selected for report: IllIllI

Also found by: 0bi, 0x040, 0x1337, 0x1f8b, 0xDjango, 0xNazgul, 0xNineDec, 0xRajeev, 0xSky, 0xSmartContract, 0xbepresent, 0xkatana, 0xmatt, 8olidity, Aymen0909, Bjorn_bug, Bnke0x0, CertoraInc, Ch_301, Chom, CodingNameKiki, Deivitto, DevABDee, DimitarDimitrov, Dravee, ElKu, Funen, GalloDaSballo, GimelSec, Guardian, Haruxe, JC, JansenC, Jeiwan, JohnSmith, KIntern_NA, Lambda, LeoS, Noah3o6, Olivierdem, R2, RaymondFam, Respx, ReyAdmirado, Rohan16, Rolezn, Ruhum, Saintcode_, Sm4rty, SooYa, Soosh, TomJ, Tomo, Trabajo_de_mates, Waze, _Adam, __141345__, ajtra, android69, asutorufos, auditor0517, berndartmueller, bobirichman, brgltd, c3phas, cRat1st0s, carlitox477, catchup, cccz, csanuragjain, d3e4, delfin454000, dipp, djxploit, durianSausage, erictee, exd0tpy, fatherOfBlocks, gogo, hyh, ladboy233, lukris02, mics, mrpathfindr, natzuu, oyc_109, p_crypt0, pashov, pauliax, pfapostol, prasantgupta52, rajatbeladiya, rbserver, ret2basic, rfa, robee, rokinot, rvierdiiev, sach1r0, saian, seyni, shenwilly, sikorico, simon135, sryysryy, sseefried, throttle, tnevler, tonisives, wagmi, xiaoming90, yixxas, z3s, zkhorse, zzzitron

Awards

35.6777 USDC - $35.68

Labels

bug

QA (Quality Assurance)

External Links

Link to GitHub issue

QA REPORT

[QA 00] Improving precision at the following calculations by preferring a mathematical multiplication instead division

inequation of the form x / y < z can be transformed into x < z * y to increase precision.

Proof of concept:

NounsAuctionHouse.sol#L109

[QA 01] Use safeTransfer instead transfer in the following locations

Proof of concept:

[QA 02] Some tokens needs approve 0 before any approve above 0

Consider using increase/decrease approve notation instead approve to deal with that.

Proof of concept:

NounsToken.sol#L139

[QA 03] Timelock is missing for the following functions

Proof of concept:

[QA 04] Use SafeMath in the following contracts to avoid unexpected overflow/underflow

Proof of concept:

Multicall2.sol

[QA 05] Use two steps verification for the following contracts

Proof of concept:

NounsDescriptorV2.t.sol

[QA 06] Put hte nonReentrancy modifier first in the following functions

A best practice is to put the nonReentrancy modifier first.

Proof of concept:

NounsAuctionHouse.sol#L96

[QA 07] Missing event indexers

Proof of concept:

[QA 08] Remove the name from the following unused function parameters

Proof of concept:

[QA 09] Both return statement and named return

For readability purposes consider having one of the two return options (for the following functions)

Proof of concept:

[QA 10] Not emitted event for state changes

Proof of concept:

[QA 11] Magic number, consider using named constant instead.

Proof of concept:

Findings Information

🌟 Selected for report: IllIllI

Also found by: 0x040, 0x1f8b, 0xDjango, 0xNazgul, 0xNineDec, 0xSmartContract, 0xbepresent, 0xc0ffEE, 0xkatana, 2997ms, ACai, Amithuddar, Aymen0909, Ben, BipinSah, Bjorn_bug, Bnke0x0, CertoraInc, Ch_301, Chom, CodingNameKiki, Deivitto, DevABDee, DimitarDimitrov, Diraco, Dravee, ElKu, EthLedger, Fitraldys, Funen, GalloDaSballo, GimelSec, Guardian, IgnacioB, JC, JohnSmith, Junnon, KIntern_NA, Lambda, LeoS, Noah3o6, Olivierdem, Polandia94, R2, Randyyy, RaymondFam, Respx, ReyAdmirado, Rohan16, RoiEvenHaim, Rolezn, Ruhum, SaharAP, Saintcode_, SerMyVillage, Shishigami, Sm4rty, SooYa, TomJ, Tomio, Tomo, Waze, Yiko, _Adam, __141345__, a12jmx, ajtra, ak1, bobirichman, brgltd, bulej93, c3phas, cRat1st0s, carlitox477, catchup, ch0bu, d3e4, delfin454000, djxploit, durianSausage, erictee, exolorkistis, fatherOfBlocks, francoHacker, gogo, hyh, ignacio, jag, joestakey, karanctf, ladboy233, lucacez, lukris02, m_Rassska, martin, medikko, mics, mrpathfindr, natzuu, newfork01, oyc_109, pauliax, peritoflores, pfapostol, prasantgupta52, rbserver, ret2basic, rfa, robee, rokinot, rotcivegaf, rvierdiiev, sach1r0, saian, samruna, seyni, shark, shr1ftyy, sikorico, simon135, sryysryy, tay054, tnevler, wagmi, zishansami

Awards

16.6802 USDC - $16.68

Labels

bug

G (Gas Optimization)

External Links

Link to GitHub issue

GAS REPORT

[GAS 00] Cache the array size for the following loops over array

Proof of concept:

[GAS 01] abiEncodePacked() instead abiEncode() in the following locations

Proof of concept:

[GAS 02] transferFrom(address(this), to, amount) can be changed to transfer(to, amount) to save gas

Proof of concept:

NounsAuctionHouse.sol#L232

Nouns DAO contest - sikorico's results

A DAO-driven NFT project on Ethereum.

General Information

Findings Distribution

Researcher Performance

External Links

[Q-25] QA Report - $35.68

Findings Information

Awards

Labels

External Links

QA REPORT

[QA 00] Improving precision at the following calculations by preferring a mathematical multiplication instead division

Proof of concept:

[QA 01] Use safeTransfer instead transfer in the following locations

Proof of concept:

[QA 02] Some tokens needs approve 0 before any approve above 0

Proof of concept:

[QA 03] Timelock is missing for the following functions

Proof of concept:

[QA 04] Use SafeMath in the following contracts to avoid unexpected overflow/underflow

Proof of concept:

[QA 05] Use two steps verification for the following contracts

Proof of concept:

[QA 06] Put hte nonReentrancy modifier first in the following functions

Proof of concept:

[QA 07] Missing event indexers

Proof of concept:

[QA 08] Remove the name from the following unused function parameters

Proof of concept:

[QA 09] Both return statement and named return

Proof of concept:

[QA 10] Not emitted event for state changes

Proof of concept:

[QA 11] Magic number, consider using named constant instead.

Proof of concept:

[G-31] Gas Report - $16.68

Findings Information

Awards

Labels

External Links

GAS REPORT

[GAS 00] Cache the array size for the following loops over array

Proof of concept:

[GAS 01] abiEncodePacked() instead abiEncode() in the following locations

Proof of concept:

[GAS 02] transferFrom(address(this), to, amount) can be changed to transfer(to, amount) to save gas

Proof of concept:

[GAS 03] Unnecessary caching of msg.sender

Proof of concept: