Post-Judging QA

[thebrittfactor]

1. Please post feedback about specific findings on the relevant issue in this repo.
2. More general feedback for the judge can be shared here.

The judge for this contest is @Picodes.

Reminders

• Please keep your comments as fact-based as possible.
• C4 judges have final authority in determining validity and severity.
• You are welcome to start new discussions here!
• Please link to specific issues wherever relevant.

Thank you!

[stalinMacias]

Hey @Picodes , first of all, thanks for the incredible work you did on judging this contest 🫡

I left some comments on issues #220 , #232 & #99

Looking forward to reading your thoughts about them

[Picodes]

Thanks for your comments and for flagging the sponsor's answer below!

[0xbtk]

Hey @Picodes, great job on judging this contest!

I left a comment on #205

[Picodes]

Hi! Just answered

[0xbtk]

Hi @Picodes

I just answered to your comment on #205

Please check it. Thank you!

[catellaTech]

Hello, @Picodes! thanks for the great job judging this contest! i left a comment on #395

[Picodes]

Thanks! I just answered your comment.

[yixxas]

Great work from @Picodes as always.

#129 looks like a partial dupe of #264 rather than a stand alone medium. #264 covers the entirety of non conformation to ERC4626 and also further expands on how funds can be stolen. #129 stops at identifying the non conformation to ERC4626.

[Picodes]

@yixxas thanks a lot for flagging. My initial reasoning was that #264 is both a duplicate of #439 and of #129 as it highlights 2 issues: the non-compliance and the scenario of loss of funds which has to me nothing to do with ERC4626 but is due to the casting.
So I flagged it as a dupe of #439 as it is worth more. But on second reading, the correct way to proceed is to duplicate the report to mark it as a duplicate of both #439 and #129.

[aktech297]

@Picodes I am just curious to know about the feasibility of the attack in issue #439

The max value of uint.96 is 79,228,162,514,264,337,593,543,950,335.

Even if we take 18 decimal value ( contract is expected assets with <=18 decimal places), the max value would be 79,228,162,514,264 * e18.

I am wondering how possible such a huge value of fund in the real life ?

Any insights would be much useful.

Appreciate your judging.

[Picodes]

I find 79,228,162,514 ~ 79B for a 18 decimal token, which seems doable considering a token with a low valuation and a flash loan. Note although that I don't see where it is specified that the contract only works for tokens with less than 18 decimals.

[aktech297]

Hey @Picodes thanks for your reply. I was asking for learning purpose..

Pls check, its not 79B, its more than that. I think you have omitted 3 places. The value I referred is 79,228,162,514,264 ,

[Picodes]

2**96/1e18=79228162514 ?

[aktech297]

Thanks for your reply.. tbh,, in our country currency, the value is around ~8k crores.. really big one.
Anyway thanks for your kind reply.

[auditor0517]

@Picodes I wrote a comment in #382. Please have a look. Thank you.

[Picodes]

Thanks @auditor0517. Just answered.

[0xbepresent]

Hi @Picodes

I left some comments in #151 and #217

Thanks for your time!

[Picodes]

Hi! Just answered your comments.

[udsene]

Hi @Picodes
Thanks for your efforts in judging this contest!

I left a comment in #470.

[Picodes]

Thanks for flagging!

[0xRizwan]

Hello @Picodes

Can you please check #246

Thank you!

[Picodes]

Just answered!

[0xRizwan]

Hi @Picodes

I just answered to your comment on #246

Please check it.

Thank you!

[stalinMacias]

Hey @Picodes , I was looking at the valid findings and noticed a comment from the sponsor on issue #307 , I'm just bringing it to light during the Post-Judging, so it doesn't; get missed