Post-Judging QA

[thebrittfactor]

1. Please post feedback about specific findings on the relevant issue in this repo.
2. Post a comment in this discussion linking to all findings you've commented on, along with any general feedback for the judge.

The judge for this contest is @MiloTruck.

Both the Validation repo and the Findings repo will be open to wardens with the SR role, for the purposes of post-judging QA.

• All post-judging QA requests must be posted in this Github Discussion in the findings repo.
• QA and Gas reports closed by Validators (i.e. not added to the findings repo) are NOT eligible.

Reminders

• Please keep your comments as fact-based as possible.
• C4 judges have final authority in determining validity and severity.
• Please link to specific issues and don't try to start discussions here.
• Please familiarize yourselves with our Good Citizen Policy.

Thank you!

[deeplake31337]

left a comment at code-423n4/2024-07-karak-validation#344

[quentin-abei]

Hello @MiloTruck thanks for the judging, i have left a comment on code-423n4/2024-07-karak-validation#142 because it have been wrongly validated by validators, and it's a dupe of #93 . Please review it thanks.

[ABDuullahi]

Hello @MiloTruck , thanks for ur time here .

i left some comments on 89 , 154, 167 and 173

Thanks.

[ABDuullahi]

left another comment here @MiloTruck .

Thanks.

[ABDuullahi]

sorry for the back and forth @MiloTruck , i hope this helps .

[coffiasd]

hello @MiloTruck
i left comments on 191,76,82
thanks

[Saptarshi1010]

hello @MiloTruck thanks for judging left some comments on
104
108

[Saptarshi1010]

@MiloTruck Ik that PJQA is over , just wanted to get a clarification why did some of the issues which stated about rebasing went invalid due to FOT being OOS

[kazantseff]

Hey @MiloTruck,
Thank you for your effort in judging!
I've left a comment on #4

[rodiontr]

Hi @MiloTruck Thanks for judging! Left a comment on #80

[lanrebayode]

@MiloTruck
Left comment on #59, #31, #165 and #101

[Pheonix244001]

Hi @MiloTruck
I have described my rationale behind this bug
Please judge it or point out my mistakes if any so that I can improve in future.
Regards,
Phoenix

[LyuboslavVeliev]

Hello @MiloTruck,

Thank you for the judging. Kindly asking you to take a look at my comment on this issue: 308.

Best wishes!

[trachevgeorgi]

Hi @MiloTruck,

I have left comments on 220, 207, 205 and 225

I would appreciate it if you would take another look at the issues.

[trachevgeorgi]

I have also just escalated 230.

[gesha17]

Hello @MiloTruck,

Thanks for judging. I left comments on #27 and #25.
Kindly asking you to take another look at those issues please.

[TradMod]

Hey Judge Sahab @MiloTruck

I have left comments on

1. Slashing limit will be bypassed if any staker (finish) redeems their tokens in the SLASHING_VETO_WINDOW which will result in other vault's stakers facing more assets slash  #24
2. A Malicious DSS can easily bypass the slashing limits and slash all the Assets in a Vault  #28

Thanks!

[TradMod]

Also on, #55 (comment)

[TradMod]

And Also on, #4

[TradMod]

Andddd also on, #31 (comment)

[anthonyshiks]

Hi @MiloTruck left a comment on #64.

[ololade97]

@MiloTruck, kindly look at issue #181.

[10xhash]

Hey @MiloTruck, can you please check code-423n4/2024-07-karak-validation#219

[AxelAramburu]

Hello @MiloTruck, thanks for your time,

I think you can take a look at these three issues in karak-validation :

#261 & #263 & #272

[cryptostaker2]

Hello @MiloTruck! thanks for judging,

Left comments on validation 58 and 59.

58, 59

Thanks!

[rbserver]

Hi @MiloTruck, thanks for judging!

I've left #22 (comment). Please take a look when you get a chance.

[Brivan-26]

Hi @MiloTruck thanks for judging.

Please take a look at issue 319 in the validation repo, it was invalidated by validators which I believe is a valid issue. The issue describes that if DSS initiates a slashing request and the contracts are paused afterward before the Veto verifies the slash request, the slash can happen immediately without veto's review after the contracts are unpaused.
This issue becomes a high risk since malicious DSS can front-run pause transactions to request slashing honest vaults, and after the unpause and if the 2 days have passed, the slash can be finalized immediately

[0xTester]

Hello @MiloTruck, I think this issue 287 was erroneously invalidated, it should be considered a dupe of 93. Thank you!

[KupiaSecAdmin]

Hello @MiloTruck,

Thank you for your judging.
Hope you have a look at #30, #31, and #36.
Also, added a comment on #40.

[Vancelott]

Hello @MiloTruck,

Please have a look at #238 in the validation repo. Thanks in advance!

[Rhaydden]

Hi @MiloTruck. Thank you for judging this contest.

Please have a look at 7, 4 and 61

[tpiliposian]

Hey @MiloTruck.
Could you please have a look at these:
#228
#250
#256

[0xCiphky]

Hey @MiloTruck,

I left comments on #4and #7.

Thank you.

[Bauchibred]

Hi MiloTruck, thanks for judging the contest, left some comments on: 133, 134, 139 & 140.

[MiloTruck]

From this repo:

• Upgrade #36 from QA to high.

From the validation repo:

• #219 as a duplicate of #29.
• #311 as a duplicate of #29 and marked as best.
• #167 as a duplicate of #15.
• #256 as a duplicate of #4.

To ask:

• Users can potentially avoid the slashing mechanism by transferring their shares to the vault 2024-07-karak-validation#191
• DSS can deposit assets into the vault by oneself, which can lead to vault users losing more slashed assets #76
• Validators can prevent the slash store from receiving slashed funds 2024-07-karak-validation#230

[0xcats]

Sorry for the late comment but I don't quite understand why #311 in the validation repo is not reviewed. I believe it's a duplicate of #29 in the findings repo. Would greatly appreciate if it could be checked out.

[MiloTruck]

It is a duplicate, thanks for flagging!

[hattiepwvi]

Hi, @MiloTruck,

Could you please check the Issue#105 code-423n4/2024-07-karak-validation#105

ExtSloads Function Returns Empty Array, Preventing Querier Contract from Fetching Vaults Queued for Withdrawal#105

Thank you very much