Post-judging QA

[itsmetechjay]

🧑‍⚖️ Post-judging QA; deadline: 02/23/2023 9:45 AM CST

1. Please post feedback about specific findings on the relevant issue in this repo.
2. More general feedback for the judge can be shared here.

The judge for this contest is @kirk-baird.

Reminders

• Please keep your comments as fact-based as possible.
• C4 judges have final authority in determining validity and severity.
• You are welcome to start new discussions here!
• Please link to specific issues wherever relevant.

Thank you!

[csanuragjain]

@kirk-baird
I think #41 (changing claim signer address) could be Medium as this is similar to #425

Can you suggest

[kirk-baird]

I don't agree the 'Claim signer address' issue should be Medium.

Changing the claim signer address was raised by a few people but was rated QA. The reasoning behind this is that it will only invalidate the signatures, the new signer will then be able to resign the required mints off-chain and they can then be published.

#425 is different in that it will break the receipt minting functionality since QuestFactory.mintReceipt() cannot be called.

[JeffCX]

Hi @kirk-baird Thanks for judging the contest.

I strongly think this issue is a medium instead of a QA

#126

The issue is about the clustered NFT metadata image rendering.

To be honest, the first thing when user evaluating an NFT in the second marketplace is by inspecting the image metadata. Seeing a image with a clustered metadata would heavily discourage buyers doing trading in the second marketplace.

According to the judging criteria,

https://docs.code4rena.com/awarding/judging-criteria/severity-categorization

2 — Med: Assets not at direct risk, but the function of the protocol or its availability could be impacted, or leak value with a hypothetical attack path with stated assumptions, but external requirements.

The impact above can fit well into the category because the availability of the image metadata is heavily impacted because the metadata renderer is meant to and built to render accurate information about the NFT.

For the reason above I strongly believe the #126 and #127 (comment) are medium issue instead of QA issue.

I acknowledge the judge has the final authority to make final judgement and I respect judge's final decision with no further argument.

Thank you!

[kirk-baird]

These are both valid issues and good finds. I did raise these with other judges to get a second opinion at the time of judging and the consensus is that they are Low severity issues.

The reasoning is the 3rd party evaluations are not considered a loss of funds and the impact of incorrectly rendered NFTs is a low impact.

[JeffCX]

Thank you for your response

[CodingNameKiki]

Hey @kirk-baird l have two QAs right now the first one is selected for report and grade a #619 and the second one is downgraded to QA and grade b #634 Not sure how this works, so wanted to mentioned it.

[kirk-baird]

#619 was the one selected for the report ;) I'll upgrade the other for consistency but it shouldn't impact the judging calculations as it's not the original QA issue.

[El-Ku]

I am looking at issue #119, I think the duplicates should be considered as a medium only if it mentions the "front running" aspect of the issue.

If the original owner has already claimed it and then tries to sell the nft(in a different block), then its the duty of the buyer to check if its still unclaimed before buying. But if its front running, the issue becomes a smart contract hack and so a medium issue. So it makes sense for me to remove duplicates of 119, which doesnt mention about "front running".

Please recheck these issues: #694, #611, #562, #445 and #315.

[kirk-baird]

I don't believe that is is strictly necessary to have the words "front-running" in the issue description to mark them as duplicates. The linked issues describe the same attack vector of how NFT can be sold, without benefit to the receiving party as claim() has already been called.

Whether the NFT is is claimed before registering it to another market, during it's sale on the other market or by front-running the purchaser is a valid distinction but not enough of a distinction to remove the duplication.