Post-Judging QA

[thebrittfactor]

1. Please post feedback about specific findings on the relevant issue in this repo.
2. More general feedback for the judge can be shared here.

The judge for this contest is @alcueca.

Reminders

• Please keep your comments as fact-based as possible.
• C4 judges have final authority in determining validity and severity.
• You are welcome to start new discussions here!
• Please link to specific issues wherever relevant.

Thank you!

[catellaTech]

Hi, @alcueca! thanks for the great job... i left a comment in #446.
Have a great day!!!!

[alcueca]

Switched #446 to be selected for the report. Please have a look at #452 as of clues on how to make your reports even better in the future. Likewise, the warden submitting on #452 can learn a few things from your report.

[alcueca]

Ultimately it is a close call, but I'm leaning towards completeness and value for the sponsor, against excellence in just one particular section.

[catellaTech]

Thank you! I will take it into account for the next reports, thanks for the time.

[JeffCX]

Left comments on #62

While I fully respect judge's expertise, I think centralization risk can more fit towards QA or analysis report, I would politely dispute that the severity is definitely not high

[JeffCX]

left comments on #324

[alcueca]

Kept #62 and #288 as they are, with comments. Fixed #77. Downgraded #372 and #324 as suggested.

Thank you.

[JeffCX]

left more comments on #62

[JeffCX]

left comments on #182

[JeffCX]

@alcueca srry in case the above comments are missed I know judge has other report to review

[deadrosesxyz]

Hey, 2 quick comments:
.1. I think #294 has wrongfuly been dupped to #288, they are 2 seemingly different issues
2. left a comment on #301

[deadrosesxyz]

also left a comment on #288

[alcueca]

Thanks for your feedback. #294 is now invalid. #301 is grade-b QA. Agree with the comment in #288.

[alcueca]

I'm still reviewing #294. vote_for_gauge_weights got hands.

[deadrosesxyz]

@alcueca I left a PoC as a comment on #294

[alcueca]

Restored #294 to Medium

[alcueca]

Hi all, please let me remind you that for every High or Medium with duplicates, submissions without executable PoC are scored at 50%, and only submissions with PoC are considered as best.

[mcgrathcoutinho]

Hi @alcueca , thank you for your hard-work on judging this contest.

I have left my comments on #58

I appreciate you taking the time to read this.

[alcueca]

After consideration, I've merged #182 and #245 into one, as the root cause and mechanics are so similar. I've also upgraded the group to High, as locking CANTO for an additional 5 years bears an extremely high risk of losses. If the vulnerability would be used in a malicious manner, the lock could be maintained for a very long time.

[QiuhaoLi]

Hi @alcueca , thanks for the judging! I left a comment on #328 , could you give it a check?

[alcueca]

Stays as QA, sorry.

[QiuhaoLi]

@alcueca Hi, thanks for the review. But reward set by the gov is amount per epoch for all markets, not specific for the blacklisted market, so not a error by the governance.

[QiuhaoLi]

@alcueca I added a comment, could you check it please?

[alcueca]

You are right, and I don't want to make this look like I'm searching for ways to invalidate your finding. However, the vulnerability that you describe can be avoided by careful construction of governance actions. Even if governance would be unaware that they have to set the weights to zero when blacklisting a market, a few unwarranted claim operations would be enough to alert them and remedy the situation forever at a low cost.

[Simao123133]

Hi @alcueca, added a piece of information on issue #433
Could you take a look?
Thank you!

[alcueca]

Still invalid, sorry.

[BenRai1]

Hi @alcueca , I left a comment on #310 , could you take a look?

[alcueca]

You are right and delegating has the same effect as increasing the lock amount, therefore the finding is invalid.

[14si2o]

Hi @alcueca

I left a comment in #324, could you take a look please?

Thanks,
Flint

[alcueca]

Stays as QA, sorry.

[merteren1234]

hi @alcueca i know QA period exceed but can u look at #419 ,#435 and #449 because u wrote if there is no POC u will give partial-50 but i linked a photos of problem's test. so i think i provided POC for this issues. In short i think this can be considered as satisfactory instead of partial-50.

[alcueca]

Full credit given, may I ask why linking photos instead of pasting code?

[merteren1234]

İ thought link photos is fine

[alcueca]

I guess they are, it is just unusual.

[merteren1234]

Thanks for changing

[alcueca]

This was a very difficult contest to judge, due to the codebase being so difficult to understand as well. I apologize for the number of misjudgements on my part, and I appreciate the input from you all. If any of you are still unhappy with my job, I hope to err on your side next time. Good luck everyone.

[eugenioclrc]

Hi @alcueca could be that you forget to update the L04 on #159 (comment) as a dup of #71 ?

[alcueca]

L-04 GaugeController allows for quick vote voting strategy
This means that an attacker can wait to the last moment to submit their votes manipulating the outcome. Consider add a voting weight decreasing over time.

Sorry, but the finding talks (very briefly) about waiting to the last moment to vote to manipulate the outcome (of the vote, we assume). There is no mention about unfair distribution of rewards, which is the impact of #71.