Post-Judging QA

[thebrittfactor]

1. Please post feedback about specific findings on the relevant issue in this repo.
2. More general feedback for the judge can be shared here.

The judge for this contest is @Trumpero.

Reminders

• Please keep your comments as fact-based as possible.
• C4 judges have final authority in determining validity and severity.
• You are welcome to start new discussions here!
• Please link to specific issues wherever relevant.

Thank you!

[0xJCN]

Hi @Trumpero,

Thank you for judging this contest.

I left some comments in #941, #479, #477, #556, #476, #472, and #473.

Thanks!

[kazantseff]

Thank you for your work, @Trumpero,
left a comment on #1057

[kazantseff]

left a comment #1182

[stalinMacias]

Hey @Trumpero Great work judging this contest, you and the sponsor did an incredible job filtering out a lot of inflated and invalid reports. hurra for that, post qa for this contest looks like it won't be a warzone :)

I wanted to ask you if #184 should be a dupe at a 50% of #685

#685 - This report covers the scenario of block stuffing as well as the potential issues with erc777, whilst #184 only talks about erc777. I don't feel like #184 should be awarded as a separate finding when there is another report more complete already covering the same issue.

Let me know your thoughts about it.
Many thanks

[SovaSlava]

Hey @Trumpero left comment in #583

[0xNentoR]

Hi @Trumpero,

Thank you for judging this contest. I've dropped comments in #928 and #740.

[thenua3bhai]

Hi @Trumpero Thanks for judging.
Please check comment on issue #1033
Thanks

[hungdoo]

Hi @Trumpero,
Thanks for judging.
Left a comment at #1224
Thanks

[kadenzipfel]

Hey @Trumpero, please see my comments on the following issues:

• Deployment script deploys the rateLimitedCreditMinter with a maxRateLimitPerSecond of 0 even though it intends to have a non-zero rateLimitPerSecond in the future #284
• Unsafe ERC20MultiVotes logic allows attackers to use flashloans to manipulate governance proposals #269
• LendingTerm.debtCeiling is incorrectly limited by creditMinterBuffer, resulting in locked gauge weight #273
• Can manipulate the debt ceiling to borrow beyond it #307

[kadenzipfel]

@Trumpero please see my response on #269

[jorgect207]

hey @Trumpero thanks so much for you excelent work,

i left some comments in #798 and #460

[Slavchew]

Hey @Trumpero,

I left some comments in #1026, #597, #262, #1038, #906

Thanks

[blckhv]

Hey @Trumpero,
Left a comment under: #335

Thanks

[etherSky111]

Hi @Trumpero ,
Thanks for your great work.

Left a comment in #186.

[etherSky111]

Hi @Trumpero ,

Thank you for reviewing my comment.
I believe I should offer additional information to your comment, so I've left a comment in #186.

Thanks again.

[klau5dev]

Hi @Trumpero

Left a comment in #956

Thanks!

[pavankv241]

Hi @Trumpero ,

I've left comment on issues #575 and #533.

Thanks for time and consideration.

[serial-coder]

Hi @Trumpero,

Thanks for judging the contest; I have left comments on:

• Issue Re-triggering the canOffboard[term] flag to bypass the DAO vote of the lending term offboarding mechanism #1141
• Issue Replay attack to suddenly offboard the re-onboarded lending term #1147
• Issue Hardcoded POLL_DURATION_BLOCKS causes lending term offboarding polls' lifetime to be too short for voting on several chains #1131
• Issue Lending term can be permanently DoS(ed) from being onboarded #1125

Thanks!

[serial-coder]

I've left another comment on #184.

Thank you for your time.

[Bauchibred]

Hi @Trumpero, thanks for judging, left a comment on #1244.

[NicolaMirchev]

Hey, @Trumpero

Please check #599 #1125

[rvierdiiev]

hello @Trumpero
i have left comment in #544

thanks

[0xSilvermist]

Hey @Trumpero, thanks for judging, left a comment on #1235

[viraj124]

Hi @Trumpero
can you please check
#675
#754
#826

We think these should be valid issues
Thanks

[0xbtk]

Hey @Trumpero, thanks for judging.

Left a comment at #292, #816, #957, #491, #994, #685, #69

[0xbtk]

Hey @Trumpero, responded in #491

[0xEVom]

Hi @Trumpero, left a comment on #1259 and #1257, appreciate your time.

[santipu03]

Hi @Trumpero, first of all, thanks a lot for the effort in judging.

I left some comments on issues #376, #379, #383, #390 and #451.

Thanks for your time.

[santipu03]

I've left another comment at #376.

Thanks for your time.

[nonseodion]

Hi @Trumpero please check

#746
#917
#595

[alexzoid-eth]

Hey @Trumpero, take a loot at #1074 please

[RunSoul22]

Hi @Trumpero, thank you for your effort in judging.

I left some comments on issues #1002

Thanks for your time.

[RunSoul22]

I've left another comment on #294.

Thank you for your time.

[rbserver]

Hi @Trumpero, thanks for judging!

I left some comments in #785 and #794. Please take a look when you get a chance.

[Tendency001]

Hi @Trumpero, many thanks for the judging effort.
I would like you to have a second look at issue #300

In this issue I also described how the bricking could be a planned attack and not just a governance error, if it was just a governance error I would have submitted it as a low, as described in the report, I believe the issue falls under medium severity, thanks.

[Trumpero]

The natspec and docs of the forgive function also state that the forgive function should be only called when repay and call are inactive/bricked (due to blacklisted USDC or other reverting). Therefore, forgiving a loan directly in the LendingTerm contract when it is still callable should be considered a mistake by governance. So it should be a QA issue due to C4's criteria.

• Mistakes in code only unblocked through admin mistakes are QA-level

[carrotsmuggler]

@Trumpero thanks for the judging. I think #69 is overinflated severity, and left a comment on that. Should be low in my opinion

[thebrittfactor]

Just a note that Post-Judging QA ended on the 3rd. Thanks!