QA Report - Githubissues

c4-bot-1 commented 5 months ago

See the markdown file with the details of this report here.

c4-pre-sort commented 5 months ago

minhquanym marked the issue as high quality report

dantaik commented 5 months ago

The following are fixed in https://github.com/taikoxyz/taiko-mono/pull/16627/files:

Consider initializing ContextUpgradeable contract by calling __Context_init() in TaikoToken.sol
Missing address(0) check for USDC in USDCAdapte
__ERC1155Receiver_init() not initialized in ERC1155Vault
MerkleClaimable does not check if claimStart is less than claimEnd
[N-07] Incorrect natspec comment for proveMessageReceived()

https://github.com/taikoxyz/taiko-mono/pull/16628 fixes:

Missing source()/canonical() function on BridgedERC115 contract fixed by

https://github.com/taikoxyz/taiko-mono/pull/16647/files fixes:

Missing unchecked arithmetic in for loops is handled by solc compiler 0.8.22 onwards
Typo in comment in Bytes.sol

c4-sponsor commented 5 months ago

dantaik (sponsor) confirmed

c4-judge commented 5 months ago

0xean marked the issue as grade-a

c4-judge commented 5 months ago

0xean marked the issue as selected for report

0xean commented 5 months ago

[L-02] NC [L-04] NC [L-05] NC [L-08] Dupe on bot report [L-16] NC [L-18] NC [L-19] NC

everything else lgtm

mcgrathcoutinho commented 5 months ago

Hi @0xean, thank you for judging this report.

I think L-14 could be a dup of #279. It does not point out the minting limit feature of USDC but the blacklist feature, which would lead to the same impact. Imo since it shows/entails how another feature of USDC causes the same issue to arise, it might fall under the same reasoning.

Nonetheless, will appreciate your decision if you think otherwise.

Thank you!

0xean commented 5 months ago

Leaving as judged.

code-423n4 / 2024-03-taiko-findings

QA Report #335

[N-07] Incorrect natspec comment for proveMessageReceived()