Spartan Protocol contest - zer0dot's results

Community-governed token to incentivize deep liquidity pools for leveraged synthetic token generation.

General Information

Platform: Code4rena

Start Date: 15/07/2021

Pot Size: $80,000 USDC

Total HM: 28

Participants: 18

Period: 7 days

Judge: ghoulsol

Total Solo HM: 18

Id: 20

League: ETH

Spartan Protocol

Findings Distribution

Researcher Performance

Rank: 18/18

Findings: 2

Award: $124.95

🌟 Selected for report: 0

🚀 Solo Findings: 0

Findings Information

🌟 Selected for report: gpersoon

Also found by: 0xRajeev, 7811, JMukesh, cmichel, heiho1, jonah1005, k, maplesyrup, shw, zer0dot

Labels

bug
duplicate
3 (High Risk)

Awards

124.9539 USDC - $124.95

External Links

Handle

zer0dot

Vulnerability details

Impact

The contracts do not use an equivalent of SafeERC20, which could result in unexpected behavior.

Proof of Concept

One example of a missing return value check is in the Dao.sol contract here

In order to maintain proper accounting, the protocol relies on workarounds like _getAddedBaseAmount() and _getAddedTokenAmount() in Pool.sol here.

Tools Used

Use SafeERC20 (or an equivalent for BEP20) to ensure expected behavior without having to use workarounds.

#0 - SamusElderg

2021-07-26T01:47:01Z

Duplicate of #8

AuditHub

A portfolio for auditors, a security profile for protocols, a hub for web3 security.

Built bymalatrax © 2024

Auditors

Browse

Contests

Browse

Get in touch

ContactTwitter