Platform: Code4rena
Start Date: 06/03/2023
End Date: 09/03/2023
Period: 3 days
Status: Completed
Pot Size: $36,500 USDC
Participants: 93
Reporter: itsmetechjay
Judge: cccz
Id: 218
League: ETH
alexxander | 1/93 | $8,080.04 | 2 | 0 | 0 | 2 | 2 | 0 | 0 | 0 |
NoamYakov | 2/93 | $4,040.02 | 1 | 0 | 0 | 1 | 1 | 0 | 0 | 0 |
Cyfrin | 3/93 | $1,814.02 | 3 | 1 | 0 | 1 | 0 | - | 0 | 0 |
adriro | 4/93 | $1,307.28 | 5 | 1 | 0 | 2 | 0 | Grade A | Grade B | 0 |
Haipls | 5/93 | $1,252.17 | 3 | 0 | 0 | 2 | 0 | 0 | Grade B | 0 |
ast3ros | 6/93 | $1,008.88 | 2 | 0 | 0 | 1 | 0 | Grade A | 0 | 0 |
anodaram | 7/93 | $925.18 | 2 | 1 | 0 | 1 | 0 | 0 | 0 | 0 |
Yukti_Chinta | 8/93 | $789.14 | 2 | 1 | 0 | 0 | 0 | - | 0 | 0 |
d3e4 | 9/93 | $713.63 | 2 | 0 | 0 | 2 | 0 | 0 | 0 | 0 |
bin2chen | 10/93 | $641.04 | 2 | 1 | 0 | 0 | 0 | Grade B | 0 | 0 |
Auditor per page
Automated findings output for the contest can be found here within an hour of contest opening.
Note for C4 wardens: Anything included in the automated findings output is considered a publicly known issue and is ineligible for awards.
There is a certain scenario when the lottery would run out of funds. This can happen in extreme scenarios when the jackpot is won in consecutive draws, while the ticket sales were low. The probability of this happening is 0.3%. This issue will not be considered valid.
Wenwin is a decentralized gaming protocol that provides developers with the ability to create chance-based games on the blockchain. The first product is Lottery, and it is the subject of this audit contest. All the contracts have extensive NatSpec comments and most of them are located in the interfaces or base contracts.
The protocol's main contracts are:
For more detailed information about the protocol, please refer to the Wenwin Lottery documentation.
All the contracts under the test and script directories.
- If you have a public code repo, please share it here: https://github.com/wenwincom/wenwin-contracts - How many contracts are in scope?: 13 - Total SLoC for these contracts?: 962 - How many external imports are there?: Open Zeppelin, ChainLink - How many separate interfaces and struct definitions are there for the contracts within scope?: 11 - Does most of your code generally use composition or inheritance?: We use inheritance for Lottery contract to divide responsibility of the contract. - How many external calls?: 3 - What is the overall line coverage percentage provided by your tests?: 100 - Is there a need to understand a separate part of the codebase / get context in order to audit this part of the protocol?: false - Please describe required context: n/a - Does it use an oracle?: true (ChainLink VRFv2 randomness oracle) - Does the token conform to the ERC20 standard?: yes - Are there any novel or unique curve logic or mathematical models?: None - Does it use a timelock function?: Yes (Native token staking implements time lock) - Is it an NFT?: Yes (Lottery Ticket is an NFT) - Does it have an AMM?: No - Is it a fork of a popular project?: false - Does it use rollups?: false - Is it multi-chain?: false - Does it use a side-chain?: false
More documentation on testing and lottery mechanics can be found in Wenwin contracts README.
rm -Rf 2023-03-wenwin || true && git clone https://github.com/code-423n4/2023-03-wenwin.git -j8 --recurse-submodules && cd 2023-03-wenwin && foundryup && forge test --gas-report
To run the tests you need to:
git clone --recurse-submodules.forge test.To generate coverage, run:
bash script/sh/generateCoverageReport.sh
It will open the HTML report in your browser.
To get the gas report, run:
forge test --gas-report
To run Slither, run:
slither .
To run Echidna tests in assertion mode, run:
echidna-test . --contract LotteryEchidna --config echidna.assertion.config.yaml
To run Echidna tests in property mode, run:
echidna-test . --contract LotteryEchidnaProperty --config echidna.property.config.yaml