code-423n4 / 2024-01-renft-findings

2 stars 0 forks source link

Analysis #631

Open c4-bot-4 opened 8 months ago

c4-bot-4 commented 8 months ago

See the markdown file with the details of this report here.

c4-judge commented 8 months ago

0xean marked the issue as grade-b

Slavchew commented 8 months ago

Hi, @0xean

Congrats on the quick judgment.

I want a revisit of this because to me, based on others that are marked as grade-a, this is also grade-a for sure.

Other analyses that are marked as grade-a, but are worse than ours.

0xean commented 8 months ago

@141345 please comment on grading here.

141345 commented 8 months ago

I want a revisit of this because to me, based on others that are marked as grade-a, this is also grade-a for sure.

  • It covers the whole project structure.
  • There are self-made diagrams of the main flows in the protocol.
  • It gives appropriate recommendations for different parts of the codebase.
  • Mention where the main issues are (do not explain them in it because this is an analysis, not an issue report).

Other analyses that are marked as grade-a, but are worse than ours.

  • Analyses that only explain issues and do not cover the analysis points and structure.
  • Analyses that explain file by file, without structuring anything, no flow path, images, etc.

my question is, do the following add any value to the sponser?

With regard to the analysis part, it is not as detailed as 380, 420, that's why I think this is a good analysis report, but not best

Slavchew commented 8 months ago

I'm not saying it's the best, but it's certainly better than others that are grade-a.

For example: #223, #386 - only provide auto-generated contract flow, deployment gas costs, etc.

Will take the note to give more security value to the sponsor rather than just explaining.

Thanks.

141345 commented 8 months ago

I'm not saying it's the best, but it's certainly better than others that are grade-a.

For example: #223, #386 - only provide auto-generated contract flow, deployment gas costs, etc.

Will take the note to give more security value to the sponsor rather than just explaining.

Thanks.

I'm not giving diagrams significant weights. Because nice graphs do not add value to sponsors in my opinion. 223 and 386 both give some suggestions and codebase/test feedback, which could be helpful to improve the protocol from different level.

This is analysis report, not summarize/drawing.