Post-Judging QA

[thebrittfactor]

1. Please post feedback about specific findings on the relevant issue in this repo.
2. Post a comment in this discussion linking to all findings you've commented on, along with any general feedback for the judge.

The judge for this contest is @MarioPoneder.

Reminders

• Please keep your comments as fact-based as possible.
• C4 judges have final authority in determining validity and severity.
• Please link to specific issues and don't try to start discussions here.
• Please familiarise yourselves with our Good Citizen Policy.

Thank you!

[visualbits]

Hi @MarioPoneder ,
Thank you for your judging.
I have left comments on issues #37 and #342.

[MarioPoneder]

Dear Wardens!
It was a pleasure judging this contest.

Some aspects to consider:

• The deadline for this post-judging QA is 2024-03-16 20:00 UTC.
  Please respect that, later comments cannot be considered.
• Please tag me in this discussion thread if you commented on an issue, otherwise I could miss it.
  Therefore, it's not necessary to tag me on the comment itself.
• Feel free to point out inconsistencies and unfairness.
  I gave my best to be precise and fair. Nevertheless, we are humans with different views/opinions and tend to make mistakes.
• Please be mindful about your own time and the potential gain when escalating QA/Analysis reports due to limited award pools of these categories.

Some insights about the judging:

• A lot of H/M findings have been invalidated or downgraded to QA due to missing/negligible impacts on the protocol/users, unrealistic assumptions and/or very low likelihood.
• Your overall QA grade is based on your QA report + all your downgraded submissions and equally applied to all of them.

Kind regards,
0xTheC0der

[DadeKuma]

Hello @MarioPoneder!

I've left a few comments here:
#34, #206, #380
Thank you for judging!

[EperezOk]

Hey @MarioPoneder, I left a comment on #369.

Thanks for the quick judging!

[trust1995]

Dear Judge,

Thanks for spending the time to thoroughly go over the submissions. I would like to contend on 3 issues:

#8 / #331

The reasoning provided for downgrading and responses are:

Deadline checks as well as slippage checks can be considered state-of-the art and a protocol bears a responsibility to introduce such measures in order to protect its users. Furthermore, the pending transaction doesn't necessarily need to fail even when frontrun by someone else and could still lead to losses (better explained in #331).

Deadline checks & slippage checks are mandatory in certain functionalities, consider for example a uniswap implementation without slippage check, which by definition can always by MEVed to death. Just an example that it is not a nice to have.
Furthermore I could provide 100s of examples where deadline/slippage checks were graded H/M, so your ruling as a class of bugs goes blatantly against consensus.
If the finding discussed a lack of deadline check in deposit() request, I would agree QA is appropriate because there's no damage done (can be immediately withdrawn). However in this function, the profitability of a call is clearly only known at the time of call and that is likely to change as prices change. Therefore there is a real risk of monetary loss.

However, also the user / MEV searcher bears a responsibility to care about their transactions as they can be cancelled easily. Having a pending transaction in the mempool for e.g. a day (see also PoC of #331) must be considered a careless user error.
See also: https://docs.code4rena.com/awarding/judging-criteria/supreme-court-decisions-fall-2023#verdict-severity-standardization-conditional-on-user-mistake

Leaving a hanging TX can hardly be considered a careless error as it requires more advanced blockchain knowledge than the average user. In the words of George Carlin, "Think about how stupid the average person is and then realize half are stupider than that". Note that the current design would force any losing racers to send a TX to invalidate the previous one, which costs additional gas ($10-$15 currently). Clearly that's an unacceptable leak of value. The Supreme Court ruling refers to blatantly stupid actions, which a preview would show has a bad effect. Here it is much more nuanced.

Looking at all perspectives it seems clear M is appropriate and would be in line with how such findings have historically been judged. Leak of value with stated hypotheticals.

#329 / #327

I request to restudy two submissions and acknowledge that these are two distinct issues with different root causes.
#327 proves that it is mathematically wrong to have a one size fits all payout amount. Fee generation per unit of time is on a very wide spectrum, and even ignoring the "long tail" there's still large differences. In order for the fees to ever pass the threshold, payout token must be reasonably low. But when it is reasonably low, the high volume pools leak an unreasonable amount for the race tax (28% in my example).
In response to judge's remark:

However, since fees can be selectively activated for high-volume pools, the "one payoutAmount fits all" consideration is not an issue.

The argument doesn't hold because:

• ALL liquidity pools (not just high-volume) are having their factory owner irreversably replaced by the V3FactoryOwner. They can no longer perform any other logic for fee collection.
• The scope / available information to wardens did not specify Uniswap is yielding any fees generated by anything lower than high-volume pools. Since that is essentially the impact shown (or setting payout amount unreasonbly low as discussed), it constitutes a valid leak of value in the Uniswap ecosystem.

#329 discusses a different issue - for ANY token pair, if trading plateaus, any pending fees are unclaimable. To drive the point home, even for high-volume pairs this will happen when trading doesn't unlock the next race, i.e. a mini-ponzi scheme. In fact to say that it wouldn't happen is to make the claim that all activated pairs will till the end of mankind perpetually accrue more and more fees at a high rate, which is a truly degenerate point of view.

The two issues describe a similar loss of yield impact, but they stem from completely different root causes, and have different fixes, hence they are to be awarded separately.

Thank you!

[DadeKuma]

FYI: I'm not trying to argue against your issues' validity, but you might have missed some info:

#8 / #331

Several other issues that have "a way out" for the user were downgraded to low severity, so I think the Judge's reasoning remains consistent here. In this case, they can either revoke the approval or send a TX with the same nonce to invalidate the previous one.

---

#327 / #329

The Sponsor has replied in another issue #37 (comment) with their reasoning:

Long tail, low liquidity pools will likely not have fees activated. Even if they do, the system behaves as designed. Waiting a long time to collect fees for such a pool is simply how the system functions. This is not an issue.

[trust1995]

Hi @DadeKuma I don't appreciate the butting in and mentioning things already addressed in my responses in an attempt to kill off the competition. Either bring new info to the table or let the judge make up their mind.

[DadeKuma]

I'm sorry you think of it this way, as it definitely wasn't my intention. Like I said, I'm not trying to argue against your submissions. What I was trying to say is that other similar issues should be treated in the same manner if this reasoning changes, to remain consistent, not only these four issues.

[MarioPoneder]

Dear Trust,
Thanks for raising your concerns and for providing elaborate insights. I've answered in the comments of the respective issues.
Best wishes!

[yixxas]

Dear Judge,

Thanks for judging! I have left a comment on #23. Appreciate your input!

[PFAhard]

Hey @MarioPoneder, I left a comment on #199.

Thanks for the judging!

[cryptostaker2]

Hi @MarioPoneder, I left a comment on #37.

Thanks for your time!

[0xA5DF]

Hey
Thanks for judging, I left a comment on #273

[Nabeel-javaid]

Hey @MarioPoneder appreciate your judging

I've left a comment on #347

[LyuboslavVeliev]

@MarioPoneder Thanks for judging this contest, appreciate your work!
I left a comment at #4. Could you please check it out?
Thanks in advance!

[Al-Qa-qa]

Hi @MarioPoneder, Thanks a lot for judging this contest.

I left comments at #34, #90.

Thanks for your time.

[akshaysrivastav]

Hey @MarioPoneder thanks for the swift judging.

I have provided some context on #80 and #205. Please have a look.

[shealtielanz]

Hello @MarioPoneder 👋🏻
I left mine in #363 #167

[andrey-kuprianov]

Dear @MarioPoneder, thank you for your judging efforts!

I have left my comment on #388.

[bronzepickaxe]

Hi @MarioPoneder,

We left a comment over at #67

Thanks!

[quentin-abei]

Hello @MarioPoneder , I left a comment on #205 , thanks for reviewing it one more time .

[DevHals]

Hi @MarioPoneder ,
I have left comments on issues #160 & #162,

Thanks!

[radeveth]

Hello, @MarioPoneder!

I left comments on:
-> #219
-> #226
-> #236
-> #221
-> #237
-> #229

Thank you for the quick judging!

[radeveth]

Hey, @MarioPoneder!

Please take final look at #206 comment, #219, #236 and #221.

I will really appreciate it

[MarioPoneder]

I've read and acknowledged your follow-ups and have sympathy/understanding for you arguing for your submissions. Nevertheless, no changes were made based on the provided arguments.

[aktech297]

Hi @MarioPoneder

Thanks for swift judging.

I left comments on #354 . Please check.

Thanks!

[etherSky111]

Hi @MarioPoneder,
Thanks for your time.
Left a comment on #218.
Thanks.

[ihtisham-sudo]

Thanks @MarioPoneder for judging.

left comment on #375

[mcgrathcoutinho]

Hi @MarioPoneder, thank you for the quick sorting and judging of this contest.

I have left my comments on #339 and #210.

Thank you for your time.

[Breeje16]

Hi @MarioPoneder,
Thanks for quick judging. I have left a comment on #107.

[udsene]

Hi @MarioPoneder,

Thanks for judging this contest.

I have left a comment on issue #169

[MarioPoneder]

The post-judging QA has concluded.
Thank you for all your valued comments!
Pretty understandable considering what's at stake and the preliminary result.

I will soon proceed to clarify my stance and/or take appropriate action in case a mistake was made.
Once the concerns were answered in the respective issue, I'll leave a 👍 on your comment in this thread.

Kind regards,
0xTheC0der

[MarioPoneder]

Regarding the conclusions of the Appellate Court

Although I've provided clear reasoning for Medium severity, there is no directly applicable standardized rule for any of those findings which could either support or refute that decision, except we view them as user mistakes.
Therefore, I agree with the presented opinions arguing for QA level.

About the highly "discussed" deadline issue #331:
Despite the resulting QA level, I am delighted that its technical validity and therefore also my integrity was confirmed.
Especially because one of the Appellate Court judges wasn't convinced by the "amicus brief" as well and seems to be in favor of Medium severity in the presence of a convincing scenario.

About the other 2 issues #45 & #205:
On the one hand, those findings bear technical validity and negatively impact users by putting an additional burden upon them, i.e. spending gas fees for an additional transaction or adapting their MEV bot due to an undocumented revert case.
On the other hand, I can also agree with the Appellate Court's reasoning as the impacts are limited and the findings can be seen as recommendations rather than issues.

That being said, I highly respect the Appellate Court's conclusions/opinions and think they should serve as a foundation for further standardization.

All in all, I appreciate that we have this process on Code4rena. This not only helped navigating this rather unique situation, but also created the fairest possible outcome for Wardens!

A personal note:
During the last 2 weeks I got many DMs supporting or questioning my decisions. This has led to some interesting discussions and a lot of mutual understanding. Anways, in total this was probably more networking than I've done in the last 4 months and clearly showed how awesome this community is. You know who you are. Thanks!

[aktech297]

Kudos for your fantastic job . .

I beleive you learned a lot.. keep going.

[MarioPoneder]

Thanks & agree, many learnt a lot from this. Interesting discussions were had and precedents were set.

[Haxatron]

Hi @MarioPoneder! Great work on judging this one, given that the "claim fees revert" finding has been downgraded back to QA, would it be possible to reassess my QA report #368 again? I left an additional comment there as well for justification: #368 (comment)

[MarioPoneder]

Effectively the AC has devalued the prior Meds and therefore doesn't automatically justify grade-a except in edge cases depending on the quality of the downgraded findings and the QA report itself.

All Wardens' QA grades, associated with the downgraded findings, were reevaluated and upgraded if necessary.
However, no downgrades were performed as this would be unfair!