Post-judging QA

[JeeberC4]

🧑‍⚖️ Post-judging QA; Deadline Monday, August 22 09:00PM PST

1. Please post feedback about specific findings on the relevant issue in this repo.
2. More general feedback for the judge can be shared here.

The judge for this contest is @0xleastwood

Reminders

• Please keep your comments as fact-based as possible.
• C4 judges have final authority in determining validity and severity.
• You are welcome to start new discussions here!
• Please link to specific issues wherever relevant.

Thank you!

[IllIllI000]

@0xleastwood If I hire an auditor to find only highs and mediums, and they don't flag oracle validation because the code is "not currently in use" but is in scope, and I end up using it and have an issue, I'm never using that auditor ever again, and will tell others to stay away too.

[0xleastwood]

@0xleastwood If I hire an auditor to find only highs and mediums, and they don't flag oracle validation because the code is "not currently in use" but is in scope, and I end up using it and have an issue, I'm never using that auditor ever again, and will tell others to stay away too.

I didn't mark the issue as invalid. I fully accept that the issue is valid, it just isn't severe because it does not impact anything in the codebase's current state. Not sure what you mean by this then ...

[IllIllI000]

If there were no QA, and the sponsor were not interested in any low/NC issues, would you mark the oracle issues here as Medium, or leave them out of the report?

[IllIllI000]

related: #190 (comment)

[0xleastwood]

You could apply this same mentality to high and medium severity issues. I don't think this is sufficient justification to treat them as medium severity issues when the report is still including them as QA.

[0x1f8b]

I remember to send a lot of front running init methods in the past, and I think that they was never considered valid or just moved to qa, I think that after this contest, this issue will be the next i++.

[0xleastwood]

Checking this out now. I think my initial understanding of how diamond pattern contracts were deployed was slightly incorrect. It seems like the primary diamond contract is also a proxy contract so I don't think this issue is all that severe. I'll downgrade it to QA.