QA Report

[c4-submissions]

See the markdown file with the details of this report here.

[141345]

1386 ZanyBonzy
l r nc
2 2 4

L 1 n
L 2 n
L 3 d dup of #586
L 4 r
L 5 d dup of #962
L 6 l
L 7 r
L 8 i bot
L 9 i bot
L 10 n
L 11 n
L 12 l

[c4-pre-sort]

141345 marked the issue as sufficient quality report

[alex-ppg]

QA Judgment

The Warden's QA report has been graded B based on a score of 10 combined with a manual review per the relevant QA guideline document located here.

The Warden's submission's score was assessed based on the following accepted findings:

Low-Risk

• 5: Attacker can drain all ETH from AuctionDemo when block.timestamp == auctionEndTime #1323

[c4-judge]

alex-ppg marked the issue as grade-b

[alex-ppg]

Hey @ZanyBonzy, thanks for following up on this! When evaluating QA reports, I have performed my independent judgment and the QA Judgment response above reflects this as I only considered 5 as a valid submission of a QA (L) issue.

[alex-ppg]

Hey @ZanyBonzy, thanks for your feedback. Per the document linked in the initial response to this submission as well as the main PJQA discussion page:

At my discretion, if a Warden has sufficiently argued in the QA report that the submission may be upgrade-able and they have focused adequately on the issue, I may reward them a reduced percentage out of the report's pool.

Your 5 statement makes no mention of the potential impact of #1323 and the impact detailed in your QA report is of a QA (L) grade or lower. To ensure transparency in the grade of your QA report, I will provide rationale for the grade of each of the report's points:

1. Submitted as part of a public PR in the contest page during its duration and thus was invalidated (QA Report #30)
2. Part of the bot report L-2
3. The code correctly checks that the bids are non-zero and have a status of true. The bids are in a strictly ascending order (when we factor in their status) meaning that no functionality needs to change. As such, I considered this a gas optimization.
4. This is a gas optimization
5. This was graded as QA (L)
6. This submission pertains to an administrator mistake that is inconsequential and falls under the relevant SC verdict with no points awarded
7. Administrators can be "de-registered" by setting their status to false, rendering this incorrect
8. All types in the referenced statement are 32 bytes in length, rendering the output of abi.encode equivalent to abi.encodePacked
9. Part of the bot report L-14
10. Typographic mistake of a comment which would be awarded an I point at best
11. The misleading string is not misleading to an extent that would warrant a change
12. This recommendation is generic and does not specify where it should be registered.

As a result of the above evaluation, I will maintain my grade B assignment which could have arguably been a grade C. Keep in mind that the A grade was awarded to a report that had at minimum 23 points which is substantially higher than yours. Even considering 3 and 6 as a QA (NC) and all I exhibits, it would bring your total to 10 + 6 + 2 = 18 which is far less than the fifth and final A report with a score of 23 (#1794).