search

code-423n4 / 2024-08-wildcat-findings

3 stars 1 forks source link

QA Report #110

Closed howlbot-integration[bot] closed 1 month ago

howlbot-integration[bot] commented 2 months ago

See the markdown file with the details of this report here.

3docSec commented 1 month ago

L-01 is very vague about what's wrong and how it should be fixed.

This test works just fine:

  function test3doc() external {
    string memory testStr = hex'0102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f202122232425262728';
    (bytes32 word0, bytes32 word1) = _packString(testStr);

    console.logBytes32(word0);
    console.logBytes32(word1);
  }

L-02 invalid - it's a feature to protect from reorgs. I'd argue that allowing "0" is not strict enough...

L-03 invalid - it's a misunderstanding. hooksTemplate is likely expecting the code to have been stored with a mechanism like SSTORE2, which prefixes the actual code with a 00 STOP operation to prevent execution in-place)

L-04 valid L, similar to #9 but I wouldn't dupe because it fails to highlight an impact

L-05 invalid - avoid collisions is the reason Transient:TmpMarketParametersStorage why is hashed as key.

Stopping here, signal to noise ratio is too low.

c4-judge commented 1 month ago

3docSec marked the issue as grade-c