code-423n4 / 2024-05-olas-findings

13 stars 4 forks source link

QA Report #109

Closed howlbot-integration[bot] closed 4 months ago

howlbot-integration[bot] commented 4 months ago

See the markdown file with the details of this report here.

c4-judge commented 4 months ago

0xA5DF marked the issue as grade-b

c4-judge commented 4 months ago

0xA5DF marked the issue as grade-c

0xA5DF commented 4 months ago

✅ Lack of checks for duplicate nominees in addNomineeEVM() and addNomineeNonEVM()

There's a check in the internal function

VoteWeighting.sol: Lack of input validation in getNextAllowedVotingTimes()

There is in the code that you quoted

StakingProxy.sol: Lack of access control for getImplementation() function

It's a view function

CrystallineButterfly commented 4 months ago

Hey @0xA5DF Thank you for judging, I notice I made mistakes with a couple of these, but I provided over 90, please re-review as I know most of these are valid. As given you said 3 are invalid there as still 88 that I suggest are valid.

All the best- Kell

0xA5DF commented 4 months ago

Those aren't just 3, those are 3 that I found by just skimming over the top of the report. Have you checked the rest 88 that they're valid before you're asking me to review them?

For example, ✅ Lack of checks for duplicate service IDs in stake() is also false since staking transfers an ERC721

CrystallineButterfly commented 4 months ago

@0xA5DF I made these lows. I understand I made mistakes but you are saying all 91 are invalid? As you skimmed over them. Please re-review the report as I made sure there is a lot more value in it than you are currently expressing. And the 3 you mentioned being invalid. The code snippets I did, I added the changes in each one. The original code isn't optimised in the ways I said. I respectfully ask you to re-evaluate the report and the 91 suggested lows.

All the best- K42

0xA5DF commented 4 months ago

I'm sorry, but this doesn't meet the standard expected for QA reports. Too many false findings, and I don't see many valuable findings here. Leaving as judged.