Platform: Code4rena
Start Date: 22/08/2022
Pot Size: $50,000 USDC
Total HM: 4
Participants: 160
Period: 5 days
Judge: gzeon
Total Solo HM: 2
Id: 155
League: ETH
Rank: 101/160
Findings: 1
Award: $35.44
🌟 Selected for report: 0
🚀 Solo Findings: 0
🌟 Selected for report: IllIllI
Also found by: 0bi, 0x040, 0x1337, 0x1f8b, 0xDjango, 0xNazgul, 0xNineDec, 0xRajeev, 0xSky, 0xSmartContract, 0xbepresent, 0xkatana, 0xmatt, 8olidity, Aymen0909, Bjorn_bug, Bnke0x0, CertoraInc, Ch_301, Chom, CodingNameKiki, Deivitto, DevABDee, DimitarDimitrov, Dravee, ElKu, Funen, GalloDaSballo, GimelSec, Guardian, Haruxe, JC, JansenC, Jeiwan, JohnSmith, KIntern_NA, Lambda, LeoS, Noah3o6, Olivierdem, R2, RaymondFam, Respx, ReyAdmirado, Rohan16, Rolezn, Ruhum, Saintcode_, Sm4rty, SooYa, Soosh, TomJ, Tomo, Trabajo_de_mates, Waze, _Adam, __141345__, ajtra, android69, asutorufos, auditor0517, berndartmueller, bobirichman, brgltd, c3phas, cRat1st0s, carlitox477, catchup, cccz, csanuragjain, d3e4, delfin454000, dipp, djxploit, durianSausage, erictee, exd0tpy, fatherOfBlocks, gogo, hyh, ladboy233, lukris02, mics, mrpathfindr, natzuu, oyc_109, p_crypt0, pashov, pauliax, pfapostol, prasantgupta52, rajatbeladiya, rbserver, ret2basic, rfa, robee, rokinot, rvierdiiev, sach1r0, saian, seyni, shenwilly, sikorico, simon135, sryysryy, sseefried, throttle, tnevler, tonisives, wagmi, xiaoming90, yixxas, z3s, zkhorse, zzzitron
35.4387 USDC - $35.44
internal
functions. The functions are:_setQuorumCoefficient
_setVetoer
_burnVetoPower
_withdraw
_setDynamicQuorumParams
Consider removing.
Change 4,000
-> 6,000
on line 86
uint256 public constant MAX_QUORUM_VOTES_BPS_UPPER_BOUND = 6_000; // 4,000 basis points or 60%
dynamicQuoromVotes
rounds in the wrong directionAt the moment there are around 420 Nouns and hence the same number of votes. If we multiply 420 by the the minimum BPS we get $420 \times 0.02 = 8.4$. However, because we are using integer arithmetic dynamicQuorumVotes
will return 8
for similar values. The ceiling function should probably be used so that, in this example, 9
votes are required rather than 8
.
_withdraw
While it is understandable that all refundable votes must succeed whether or not the refund does, the same probably doesn't hold for the _withdraw
function. Having the function revert when an ether transfer fails seems like a reasonable behaviour that will alert NounsDAO of the need to change the admin
or finding out what else has gone wrong.
Gas costs for EVM operations may change in the future so it is a good idea to allow for the change of REFUND_BASE_GAS
which is define as a fixed constant. i.e.
uint256 public constant REFUND_BASE_GAS = 36000;