Supreme Court verdicts, Autumn 2023: post-judging QA #134
Replies: 12 comments 38 replies
-
Beta Was this translation helpful? Give feedback.
-
Beta Was this translation helpful? Give feedback.
-
Beta Was this translation helpful? Give feedback.
-
Hoping our work in standardizing the rulebook will assist judges, sponsors and wardens in performing their duties and create healthy incentives for all. Regarding Verdicts QA, would like to separate between our ruling output and consultative output. Anything that isn't a rule change is not viewed in scope for QA requests, it is targeted for the staff to consider how to proceed. Feedback is of course welcome as always. For rulings, before commenting we would like to request that wardens read the entire document, as some topics are answered under other titles. We've covered all non-spam gov requests. Best of luck to all. |
Beta Was this translation helpful? Give feedback.
-
Thanks for the report and the efforts! I have two questions: 1. How will missing duplicates "escalation" be treated?
2. Could you provide clarification on Doc says about wardens:
It looks like an inconsistency, or I am missing something? |
Beta Was this translation helpful? Give feedback.
-
I've edited the original post to clarify the rules of post-judging QA. I'd also underline this comment from @trust1995:
|
Beta Was this translation helpful? Give feedback.
-
Hi, I would like to share my thoughts about "Standardize acceptance of reports based on automated findings - page 9". I have to say I am uncertain about how protocols handle bot findings, but I don't believe they address all low-severity issues identified by the bots. Frankly, I think the majority of these low-risk bot findings remain unfixed by the protocols. The current verdict regarding issues based on bot findings assumes that these bot findings will definitely be fixed and invalidates H/M issues with the reasoning that the "fix is the same". However, this verdict may result in unsubmitted and unfixed high severity bugs, as wardens will not delve deep into those low-severity bot issues due to the absence of incentives. I believe if a warden shows High or Medium impact for a low severity bot finding, it should be considered valid even if the fix is the same. Otherwise, no-one will search and submit those H/M issues, which will create false sense of security, and the sponsor will most likely not fix the underlying low severity bot finding. As I said above, I don't know exactly how protocols approach to these bot findings. You can forget all the things I said if protocols usually fix all of these bot findings. Otherwise, showing a higher impact (regardless of the fix being the same or not) might be a decision-changing added value to the sponsor. I would like to hear your opinions on this matter. |
Beta Was this translation helpful? Give feedback.
-
Urgent!!! Result can be announced anytime.. Thanks for creating such a the wonderful platform. Much needed to iron out some mistakes. I would to get judges feedback decision on this issue. I have put some comments. https://github.com/code-423n4/2023-08-chainlink-findings/issues/832 |
Beta Was this translation helpful? Give feedback.
-
Does that mean the separate issues of 'transfer() return code not checked' and 'USDT signature mismatch' are duplicates, because they can both be fixed by using safetransfer() (which internally has multiple fixes)? |
Beta Was this translation helpful? Give feedback.
-
Is this meaning to say that if you show a code path where funds are lost, that it can be med/high (i.e. that you're just trying to exclude findings that just say 'fee on transfer problem here!' and nothing else)? |
Beta Was this translation helpful? Give feedback.
-
I don't understand what specifically this is trying to say - can you rephrase? In favor of the sponsor paying less? What is the intention that could be broken? |
Beta Was this translation helpful? Give feedback.
-
There is a thread up there that mentions the appeal committee mechanism, but I'll start a new one for cleanliness. From the fundamentals, I think that the sponsor shouldn't fund the court of appeals, much less an unknown value (even within a range). It just doesn't seem fair, or good sponsor experience. Even being a small amount, it seems an unnecessary point of friction. There are a few possible ways of removing the sponsor from the mechanism. The one I like best is that in the case of a 2/3 ruling against the judge the court fee is paid 50/50 by the warden and the judge. |
Beta Was this translation helpful? Give feedback.
-
Code4rena's inaugural Supreme Court session (Autumn 2023) has reached the "post-judging QA" phase.
A draft of all Supreme Court verdicts for this session can be viewed here:
https://docs.google.com/document/d/1Y2wJVt0d2URv8Pptmo7JqNd0DuPk_qF9EPJAj3iSQiE/
Community members are welcome to post comments and questions here. To keep discussion structured, please:
Huge thanks to our Supreme Court judges: @GalloDaSballo (Alex the Entreprenerd), @dmvt (LSDan), and @trust1995 (Trust), who have done an extraordinary job of reviewing C4 "case law" and proposing improvements to rules, judging guidelines, and processes. 👏 👏 👏
Edited to add: Post-judging QA will close Friday, November 17, 2023 at 18:00 UTC.
Further edited to note post-judging QA rules.
Beta Was this translation helpful? Give feedback.
All reactions