Redacted Cartel contest - yixxas's results

Boosted GMX assets from your favorite liquid token wrapper, Pirex - brought to you by Redacted Cartel.

General Information

Platform: Code4rena

Start Date: 21/11/2022

Pot Size: $90,500 USDC

Total HM: 18

Participants: 101

Period: 7 days

Judge: Picodes

Total Solo HM: 4

Id: 183

League: ETH

Redacted Cartel

Findings Distribution

Researcher Performance

Rank: 74/101

Findings: 1

Award: $53.49

QA:
grade-b

🌟 Selected for report: 0

🚀 Solo Findings: 0

Low-01 - setRewardRecipientPrivileged() can accidentally overwrite reward recipient as it does not check if a reward recipient already exist.

https://github.com/code-423n4/2022-11-redactedcartel/blob/03b71a8d395c02324cb9fdaf92401357da5b19d1/src/PirexRewards.sol#L432-L453

Add the check if (producerTokens[producerToken].rewardRecipients[lpContract][rewardToken] != address(0)) revert alreadyAdded(); to disallow accidental overwriting of reward recipient that is previously set.

Low-02 - Unbounded length array in rewardTokens can cause users to be unable to claim rewards

https://github.com/code-423n4/2022-11-redactedcartel/blob/03b71a8d395c02324cb9fdaf92401357da5b19d1/src/PirexRewards.sol#L396

Each time rewardTokens is added, the array increase in size and there is no limit for the number of rewardTokens for a producerToken. When this happens, user will not be able to claim() rewards as the maximum block gas limit can exceed if array gets too large.

Consider adding a limit on number of possible rewardTokens that can be added.

#0 - c4-judge

2022-12-05T09:54:04Z

Picodes marked the issue as grade-b

AuditHub

A portfolio for auditors, a security profile for protocols, a hub for web3 security.

Built bymalatrax © 2024

Auditors

Browse

Contests

Browse

Get in touch

ContactTwitter