Post-Judging QA

[thebrittfactor]

1. Please post feedback about specific findings on the relevant issue in this repo.
2. Post a comment in this discussion linking to all findings you've commented on, along with any general feedback for the judge.

The judge for this contest is @alcueca.

Reminders

• Please keep your comments as fact-based as possible.
• C4 judges have final authority in determining validity and severity.
• Please link to specific issues and don't try to start discussions here.
• Please familiarize yourselves with our Good Citizen Policy.

Thank you!

[DadeKuma]

Hi @alcueca and thank you for judging. I've left multiple comments here:

#15 #11 #9 #25 #2 #22 #30 #21

[alcueca]

#2: Downgraded to QA
#9: Stays as it is
#11: Stays as it is
#15: Invalidated
#21: Downgraded to QA
#22: Downgraded to QA
#25: Downgraded to QA. Unfortuantely, cargo.toml is not in the scope, so we must assume default configuration parameters. In the future, sponsors should be clear about the release configuration, since it has considerable impact on the bytecode.
#30: Downgraded to QA

[DadeKuma]

Hi @alcueca, I've left a comment under #8 to ensure consistency, thank you

[rvierdiiev]

hello @alcueca
i left comment in #4, #5

also i have general question about #14 and #8
shouldn't they be both considered as smth like gas report for ethereum contests?(do we even have gas pool here?)
i mean if same thing will be reported on ethereum contest, then i guess it would be estimated as gas improvement
(for example i reported issue where users overpaid like 100k gas for LZ tx and you judged it as gas instead of med)

[rvierdiiev]

don't agree on #8 and #14, but will not argue further, i guess that your decisions should be consecutive in similar cases.

[rvierdiiev]

didn't mean to offend you and your judgement in any way(maybe my tone sounds like rude because of language barrier)
thank you for your work

[alcueca]

I'm not offended. I can't make everyone happy, so I will to make everyone equally unhappy. I hope I will succeed at that :)

[rvierdiiev]

i like that :)

[rvierdiiev]

i have left comment earlier in #4, but i guess that you didn't see it
pls, check it

[Arabadzhiew]

Hi @alcueca, thank you for the fast judging. I have left a comment under #34.

[alcueca]

It is, thank you

[Arabadzhiew]

Hey @alcueca, I also left a comment under #17. Thank you.

[koolexcrypto]

Hi @alcueca

I left comments on those:

#15
#14
#12
#8
#6

Update:
Also this #5

Thank you in advance

[alcueca]

#15: Already dealt with
#14: I don't think that $0.18 USD is dust on solana nowadays
#12: I'm going to need a PoC that liquidations don't work without funds on the oracle, or I'll mark it as invalid.
#8: Downgraded to QA
#6: I still see it as an issue

[koolexcrypto]

Thank you for reviewing them.
I've added additional feedback in #6 , please have a look if you don't mind. Much appreciated.

[alcueca]

#6: Donwgraded to QA
#12: Sustained, liquidate should have the oracle as an additional signer account to the liquidator account paying for the transaction costs.

[koolexcrypto]

I believe, you may have forgotten to check #5 ?

Thank you

[alcueca]

Checked again. In the future, please don't update messages.

[alcueca]

Downgraded #14 to QA as well, after drawing a completely arbitrary dust line of $1.

[Arabadzhiew]

@alcueca So you first stated that $0.18 is not a dust amount on Solana and then shortly after that, decided to draw an "arbitrary" dust line of $1 and invalidated #14 based on that? It was stated time and time again that the impact of this issue is in the accumulation of those small losses, as their number will likely be in the magnitudes of thousands. I am lost for words, honestly...

[DadeKuma]

@Arabadzhiew $0.18 is still arbitrary, and given that there are two issues with a similar cause and impact, this seems the fairest decision to me; they should have the same risk rating. Even if we consider just the Position (and not the trading pools) we are still talking about cents so an order of magnitude of difference is insignificant. If we consider the accumulation instead, both issues should be Med as losses tend to infinity given enough time.

[Arabadzhiew]

The difference between the losses caused by the two issues is almost x20. And while you are right that the accumulation of the losses from both of those issues will at one point lead to non-negligible losses, this is much more likely to happen with #14, as it requires much less positions to be opened.

Not only that, but an assumption can be made that the unused space in issue #8 is left out on purpose, as it was rightfully mentioned in this comment.

And on top of all that, even if we consider the arbitrary $1 dust line, issue #14 will need only 4 position PDAs in order to cross it, while issue #8 will need 57. What this means, is that a single user is much, much more likely to experience non-dust amount losses from #14 than they are from #8. So even this can be used as an argument towards the different severity of both issues.

Nothing personal @DadeKuma, but those are the reasons as to why I believe the severity of these two issues is different.

[Arabadzhiew]

And one final note to the judge - If you still consider both of those issues similar enough, even based on all of the things listed above, then I would kindly suggest you to upgrade them both back to medium severity. That way, you will keep things as fair as possible to all parties involved, at least IMO.

[alcueca]

I did a fair amount of thinking to come up to the conclusion of judging them both as QA, and after your comments I'm still satisfied by it. I will actually use the $1 heuristic as dust limit in the future.