Post-Judging QA

[liveactionllama]

For this audit, please post all feedback on this Discussion page for the judge to review.

The judge for this contest is @GalloDaSballo.

Reminders

• Please keep your comments as fact-based as possible.
• C4 judges have final authority in determining validity and severity.
• You are welcome to start new discussions here!
• Please link to specific issues wherever relevant.

Thank you!

[JeffCX]

hi Alex thanks for judging the contest! this is the contest with largest submission!

left some comments on #934

[JeffCX]

🙏

[GalloDaSballo]

• 934 -> Will change best report to one that tackles both
  -2094 -> Keeping as QA due to Admin Privilege Pre-Requisite
• 1142 -> Maintaining QA as the Owner is the pre-requisite

[JeffCX]

thanks 👍

[GalloDaSballo]

Saw your comment on 1012 which I think was set to Med by mistake, downgraded to QA, pls lmk if I missed your QA Report

[JeffCX]

ok no problem.

[catellaTech]

Hello, @GalloDaSballo!! hope u are doing well today. thanks for the great job in this contest.
I left a comment on #1839.
have a great day!

[0xnirlin]

Left comments on #1496 and #1926, will appreciate the second look. Thank you.

[rodiontr]

Hi, @GalloDaSballo ! Thanks for judging this huge contest! Can you please take a look again at issues #1331, #1333, #255

[Topmark1]

Hello @GalloDaSballo thanks for judging the contest! Must have taken lot of effort!! kudos!!
Left comments on #641 🙏

[hungdoo]

Hi, @GalloDaSballo ! Much appreciated for the judging effort.
Please help me look at the comments at #1416 and #1430

[nevillehuang]

Hi @GalloDaSballo really really appreciate your judging efforts.

Left some comments on #625 and #637

[rokinot]

Hi @GalloDaSballo,

Left a comment in #839

[GalloDaSballo]

Need to finish the TODO MED for QAs

[sathishpic22]

Hi @GalloDaSballo ,

Left comments on #1841 and #336

[0xToshii]

Hi @GalloDaSballo, thanks for judging!

I left comments on #2085.

[GalloDaSballo]

Thank you for your time and efforts in securing the project!

[CrystallineButterfly]

Hey @GalloDaSballo Respect to you for consistently smashing judging,

Please briefly respond on issue #291

All the best- K 😇

[jorgect207]

hi Alex thanks for judging the contest!

left some comments on #162

[bbresearcher]

Hi @GalloDaSballo
Please may I ask you to review comments on issue #1842
#1842

[bbresearcher]

@GalloDaSballo Thank you for the update, please could I ask you to check the latest comment I added?
I will accept the outcome as you decide after that.

[merteren1234]

hi @GalloDaSballo. I left comment on #982.

[c3phas]

Hey @GalloDaSballo , the winning gas report has 7L,2R while my report #1942 has 6L,4R - Despite the winning one having one more L, my report still saves more gas and I have the gas benchmarks from running the test suite included. Also there is a question of how his L are being counted, the winning report has issues listed separately ie, Instances are being counted separately eg G-07,G-08 it's essentially one finding with multiple instances but since he lists them separately , you counted 2L

[peakbolt]

Hi Alex, thanks for judging this contest in such a short time.

Appreciate it if you can take some time to review #976 and #1479, I have left my comments in them.

[GalloDaSballo]

Need clarifications on 976

[peakbolt]

Hi @GalloDaSballo,

May I request that you consider judging this issue with same criteria applied for the other high severity issues in this contest.

I am asking because, some of the issues are judged as high even when they did not show proof of considerable financial loss or complete full DoS. Reason being, it is not easy to quantify loss for those issues as there are assumptions and external factors to the loss %. So it does not make sense to apply such stringent criteria on them, which I understand.

So I feel this issue should not be downgraded just because it is easier to quantify the financial loss than the other highs. And I feel we should not apply the financial loss threshold just for this issue and not the others.

For poc, I have provided a written poc in original submission that outlined the attack vector and impact, which was clear enough for sponsor to confirm. I understand the coded poc would provide solid proof so when requested for a coded poc I have provided it to my best ability.

Pls correct me if I am wrong, there are no docs or announcements that mention the criteria of loss theshold and PoC for high severity, especially for this contest. Otherwise, I would have provided it if it had been stated upfront.

Appreciate your reconsideration on this. Thank you.

[GalloDaSballo]

I have spoken with 5 judges on the issue:

• We agree that the finding would be classified High Severity if the POC was added to the contents of the issue
• When asked about the validity of the POC, all Judges question whether it is fair to use a POC added later as a way to justify a higher severity
• The fundamental issue is that adding crucial information after the end of the contest fundamentally challenges the competitive integrity of the contest
• After being told this, I agree with the sentiment

I'm maintaining Medium Severity because the POC was not added to the original report, whereas if the POC was added to the original report, a slight tweak of it to further demonstrate impact would not be considered new information

[GalloDaSballo]

I believe you've done a phenomenal job but I think that adding the POC as "known" even though I had requested is not fair for the rules

[peakbolt]

Yes, I understand your reasoning about the issue/fairness and accept your decision. 

I will bear this in mind and improve the quality of my future submissions.

Thanks again for spending the time with the judges to review this!

[chaduke3730]

HI Alex. Thanks for judging,

1. can you take a look at RdpxV2Core.withdraw() fails to decrease totalWethDelegated. As a result, the state of totalWethDelegated and reserveAsset[i].tokenBalance for Weth might be wrong. #59?
   I wonder why 25% only.

2. Can you also take a look at RdpxV2Core._transfer() will withdraw from addresses.rdpxReserve extra Rdpx in the amount of _rdpxAmount + extraRdpxToWithdraw instead of extraRdpxToWithdraw. Due to such overwithdrawl, rdpxReserve might be depleted and loss of funds.  #55? I left a comment there too.

Thanks again

Chaduke

[T1MOH593]

Thanks for judging, left comment in #425

[flowercrimson]

Hey @GalloDaSballo, Thanks for your time! I left comments in #1784, #2153

[deadrosesxyz]

@GalloDaSballo hey, left comment on #89

[Topmark1]

Hello @GalloDaSballo
Left a concluding comments on #641

[KristianApostolov]

Thank you for judging, @GalloDaSballo!
Left some comments on #2172, thank you!

[flowercrimson]

Hey @GalloDaSballo, Please also see comments on #2128 , #2143
Thanks for your time!

[0xCiphky]

Hey @GalloDaSballo left a comment on #372

[QiuhaoLi]

Hi @GalloDaSballo, thanks for the judging :) I left a comment at #1812 and #1030 .

[GalloDaSballo]

Will review the remaining issues tomorrow, please do not send more, but feel free to reply to my comments if you've already flagged something

[0xJuancito]

Flagging missing downgraded issues for QA report as per request on Discord @GalloDaSballo

QA Report: #1033

Downgraded to QA issues:

• Removing assets bricks the reserve tokens of the Core contract #1028 (dup of 33)
• Multiple Uniswap deadlines are set incorrectly, allowing manipulation of liquidity functions #1029 (dup of 898)
• Old addresses approvals are not reset on setAddresses() #1031 (dup of 1346)

[GalloDaSballo]

If you have a Dup of #389 that I missed, please reply here

No new issues pls, just scoring QA and done

[JeffCX]

left comments on #389 aiming to flag duplicates

[GalloDaSballo]

583 is about griefing the admin so I disagree with dup
991 I think making it a dup because of the comment on volatility is a big stretch because it's not developed in the same way

[hungdoo]

Sorry for the late reply. I believe this issue #1353 is also dup of #389

[GalloDaSballo]

This doesn't look like a dup, this is griefing the admin, the above is computing the wrong funding rate

[GalloDaSballo]

PJ QA is concluded, I will wait for staff to send me QA data to make sure we didn't miss a few

[aktech297]

Hi @GalloDaSballo

seems my couple of issues are missed.

#1481 #1501

I have tagged judge but missed to comment here.. apologies..