Post-judge QA

[JeeberC4]

🧑‍⚖️ Post-judging QA

1. Please post feedback about specific findings on the relevant issue in this repo.
2. More general feedback for the judge can be shared here.

The judge for this contest is @0xean

Reminders

• Please keep your comments as fact-based as possible.
• C4 judges have final authority in determining validity and severity.
• You are welcome to start new discussions here!
• Please link to specific issues wherever relevant.

Thank you!

[zzzitron]

I think #308 and #407 are the same issue but #407 is duped into #273.
Also #415 : "L11 Heart: if the issueReward fails the heart beat will revert" is same as #378.
Also #415: "L00 Operator: incorrect accounting for fee-on-transfer reserve token" is same as #106.

[0xean]

#407 was marked as a dupe of #275 (not #273) - I agree though that it's a closer dupe to #308 and am revising now.

[berndartmueller]

I don't want to dispute anyone's rewards, but shouldn't #106 be invalid same as it's duplicate #383?

[zzzitron]

I agree

[0xean]

yup, my bad, this was mis marked.

[thereksfour]

For #308, I still consider this a high risk vulnerability due to the fact that in the current implementation.

1. the vulnerability actually steals voter_admin's privileges and makes it impossible for him to manage the votes. (because when the admin decides to revoke the vote, the honest user's vote is revoked, while the malicious user still keeps his vote)
2. when the honest user's vote is revoked, the malicious user prevents their vote from being revoked, which actually causes the honest user to suffer losses

[0xean]

As stated when you DMed me - please post a POC in the issue showing to a loss of user funds and I will revisit.

[bahurum]

In QA report #496, the issue L01 is a duplicate of medium severity finding #239

[0xean]

They are not dupes. One is talking about upgrading and the other talks about endorsing. Please clarify.

[bahurum]

It talks about upgrading the VOTES module (OlympusVote) to another contract (gOHM). They both have as a premise the use of gOHM and both point to double endorsing as the consequence of a working transfer function. I understand that at first sight #496 could look like a separate issue but I believe they describe they same issue. I understand that he quality could not be worthy of medium though.

[0xean]

Thanks for clarifying, I re-read both and do agree that these are rough dupes. I do think the #239 is significantly more complete than #496. Will award #496 as a duplicate of the M issue.

[0xean]

https://docs.code4rena.com/roles/judges/how-to-judge-a-contest#upgrading-issues-from-qa-gas-to-medium-high

I suggest you also give this a read for future QA

[0xean]

#506 <- this has been completed

[Thro77le]

#394 is marked invalid but is a duplicate of M-17 finding

[0xean]

incorrect, they are not dupes.

[Thro77le]

#394 says that vote_admin has full control over granting and revoking VOTE tokens. #442 says the same thing. The sponsor responded with the same answer that it's so by design.

@0xean Can you elaborate on why you think it is not duplicate?

[0xean]

Sure.

#394 makes a qualitative statement about design and calls it a vulnerability. #380 - talks about unintended functionality as a result of those design choices with a POC. #442 is somewhere in the middle and subjectively is much closer to #380 than #394.

I have reviewed this and as a Judge using my discretion, stand by the decision. Appreciate the feedback.