Post-Judging QA #412
Replies: 7 comments 19 replies
-
|
I don't think #123 is invalid. I believe the label Invalid should be reserved for issues that are false. At the very least this is a Non-critical/Low. Although it seems similar to issue #232 my issue does not mention other proposals, only malicious admins and also accidental overwriting of quorum parameters in the same block (leading to surprise by the proposer). Given commentary by sponsor @davidbrai (in #232) , the impact is probably low enough to downgrade this to Low Risk but in that case I feel that perhaps my QA report score should be reassessed. As I mentioned above I believe "Invalid" should be reserved only for those findings that are factually false. |
Beta Was this translation helpful? Give feedback.
-
|
M03 - Lack of zero address check (#318 and other dup instance) In all earlier judging this issue has always been marked QA. I think in this case also this should be downgraded to QA |
Beta Was this translation helpful? Give feedback.
-
|
I think there should be consistency in judging within the same contest. If the same issue can be medium if it is reported as medium and others who reported as QA will be kept as QA, it will encourage people to try as medium. In terms of payout, it is different when it is paid as medium versus paid as QA, I guess? |
Beta Was this translation helpful? Give feedback.
-
|
This has been food for thought. In future I'll try to err on the side of lower risk determination. |
Beta Was this translation helpful? Give feedback.
-
|
I always upgrade QA if any of them is judged as Med/High. Problem is that with the current number of submissions it became infeasible to look into each report in detail and would consume too much time that should be used to triage higher risk issue. Might take a break from judging before spamming is resolved lol. |
Beta Was this translation helpful? Give feedback.
-
|
Reality being sponsors want to know High risk issue that would rekt them and Low/QA is never the focus imo and should not be spent disproportional time there. |
Beta Was this translation helpful? Give feedback.
-
|
Yeah, it is difficult situation, when there are like 500 or even more QA reports... |
Beta Was this translation helpful? Give feedback.
-
|
#284 I think there is some confusion, this is agreed as valid by Product team and also this is possible to happen. Request you to kindly check |
Beta Was this translation helpful? Give feedback.
-
|
Similar issue #57 is marked Valid |
Beta Was this translation helpful? Give feedback.
-
|
I will review the issue soon, but this contest have an overwhelming amount of Low/QA issue submitted as High/Med risk. I decided to judge those as invalid if they are obviously low risk or known, otherwise it would be encouraging people to submit all Low / QA item as individual issue and see what sticks. |
Beta Was this translation helpful? Give feedback.
-
|
I wouldn't mind there being a little more consistency on the "untrustworthy admin" criterion. In many contests I see " In the case of NounsDAO and #123 an untrustworthy admin could set the minimum votes higher whenever a particular user makes a proposal, and then immediately change it back in the next block. Since it could happen, who's to say it won't one day? We shouldn't necessarily be taking the real-world trustworthiness of the NounsDAO project into account. The code should prohibit things that could cause harm in this way. |
Beta Was this translation helpful? Give feedback.
-
The admin is the gov timelock I think the risk is really low compared to a EOA or multisig |
Beta Was this translation helpful? Give feedback.
-
|
I think there may be some confusion. I'm not talking about hijacking of the admin account. I'm talking about the "rug pull" scenario. The whole point of providing source code for people to review in the DeFi space is to increase the confidence that users can have in the application.
If the possibility exists, in code, that a rug pull could happen then it should be fixed, in code.
Otherwise we might as well have centralised apps with closed source, and just trust people to do the right thing.
But perhaps I misunderstood what you meant in your reply above.
…-------- Original Message --------
On 20 Sep 2022, 16:01, gzeon wrote:
> I wouldn't mind there being a little more consistency on the "untrustworthy admin" criterion. In many contests I see "setFee to 100%" bugs which, because they are not prohibited by an untrustworthy admin, are labelled as Medium because one could do that.
>
> In the case of NounsDAO and [#123](#123) an untrustworthy admin could set the minimum votes higher whenever a particular user makes a proposal, and then immediately change it back in the next block. Since it could happen, who's to say it won't one day? We shouldn't necessarily be taking the real-world trustworthiness of the NounsDAO project into account. The code should prohibit things that could cause harm in this way.
The admin is the gov timelock I think the risk is really low compared to a EOA or multisig
—
Reply to this email directly, [view it on GitHub](#412 (reply in thread)), or [unsubscribe](https://github.com/notifications/unsubscribe-auth/AAA5TLVKGV63Z3CKWX7KANLV7FHMPANCNFSM6AAAAAAQK3MXOQ).
You are receiving this because you commented.Message ID: ***@***.***>
|
Beta Was this translation helpful? Give feedback.
-
|
The admin is the governance timelock, not the project team. It's hardly a rug pull if governance passed the proposal. |
Beta Was this translation helpful? Give feedback.
-
|
You literally can't stop the governance to self destruct they can simply transfer all eth away. |
Beta Was this translation helpful? Give feedback.
-
|
Ah, that's what you meant. I agree. Thank you for the clarification. |
Beta Was this translation helpful? Give feedback.
-
|
It's been a while since I took part in the contest and I was fuzzy on some of the details. Thanks for taking the time to clarify |
Beta Was this translation helpful? Give feedback.
-
|
Hi @gzeoneth , my L-05 is the same as M-03. https://github.com/code-423n4/2022-08-nounsdao-findings/blob/main/data/0xDjango-Q.md |
Beta Was this translation helpful? Give feedback.
-
|
ty |
Beta Was this translation helpful? Give feedback.
-
🧑⚖️ Post-judging QA
The judge for this contest is @gzeoneth
Reminders
Thank you!
Beta Was this translation helpful? Give feedback.
All reactions