search

code-423n4 / 2023-09-delegate-findings

2 stars 1 forks source link

QA Report #293

Open c4-submissions opened 11 months ago

c4-submissions commented 11 months ago

See the markdown file with the details of this report here.

0xfoobar commented 11 months ago

Useful QA report

GalloDaSballo commented 11 months ago

[L-01] previewOrder should not revert L

[L-02] Withdraw should revert with a not supported delegationType R

[L-03] Lack of data on flashloan could make some ERC1155 unusable L

[L-04] Using delegatecall inside a loop may cause issues with payable functions R

[L-05] CreateOfferer uses a custom context implementation instead of an existing SIP L

3+ L from dups

6L+ 2R

c4-judge commented 10 months ago

GalloDaSballo marked the issue as selected for report

c4-judge commented 10 months ago

GalloDaSballo marked the issue as grade-a

GalloDaSballo commented 10 months ago

By far the best submission, great work!

0xfoobar commented 10 months ago

"[L-01] previewOrder should not revert" -> the quoted documentation actually says it can revert, we're not doing order penalties here just straightforward fulfillment

"[L-02] Withdraw should revert with non-supported delegationType" -> it does

"[L-03] Lack of data on flashloan could make some ERC1155 unusable" -> acknowledged, we won't be transferring directly to staking contracts with merkle roots so this is fine

"[L-04] Using delegatecall inside a loop may cause issues with payable functions" -> but here it does not, we can see in the quoted code that it's not looping over msg.value

"[L-05] CreateOfferer uses a custom context implementation instead of an existing SIP" -> acknowledged

c4-sponsor commented 10 months ago

0xfoobar (sponsor) acknowledged