findings_example.json

[
  {
    "id": "000384c6-912a-49b5-b629-06abb81ad583",
    "repository_id": "ac757733-81a4-43c7-8f49-17c5b135cdff",
    "attributed_to": "deb0aa88-3803-45f5-9d2e-6ace4ce4421e",
    "title": " Cannot add correlated asset in Curve2PoolLPAdaptor",
    "description": "## Description\n\nWhen  adding assets to Curve2PoolLPAdaptor , to use curve pools as oracles, it performs a validation to make sure correlated assets are indeed correlated like so: \n\n```\nif (data.isCorrelated) {\n            // If assets are correlated, there will not be a lp_price()\n            // function, so this should hit the catch statement.\n        -------------------------------\n            try pool.lp_price() {\n--------------------------------------\n                revert Curve2PoolLPAdaptor__UnsupportedPool();\n            } catch {}\n        } else {\n            // If assets are not correlated, there will be a lp_price()\n            // function, so this should hit the try statement.\n            try pool.lp_price() {} catch {\n                revert Curve2PoolLPAdaptor__UnsupportedPool();\n            }\n        }\n```\n\nThe validation depends on the called method `lp_price()` to be unavailable thus causing a revert and the try catching it, but the solidity try catch function is not capable of catching an invalid method. If a function does not exist in a called contract, it reverts and the catch will be unable to catch it.  As reported here on solidity repo on github: \n[\"it crashes if the target contract doesn't have that method\"](https://github.com/ethereum/solidity/issues/13869). Because of this, it will be impossible to added a correlated asset. \n\n## Recommendation\nFind a different mechanism to validate that a correlated asset is indeed correlated.  A possible option would be using the low level call and manually parsing the result.\n",
    "status": "confirmed",
    "severity": "informational",
    "likelihood": "high",
    "impact": "high",
    "created_by": "8ebb8382-03a5-4b28-b2f4-851cf331296a",
    "created_at": "2024-04-13 19:26:31.52598+00",
    "number": 475,
    "last_updated_by": "0dab331d-76ad-4024-99f3-97eebf33a9b6",
    "fixed_by": "{}",
    "duplicate_of": null,
    "points": 0.0,
    "quality": null
  },
  {
    "id": "00113f68-4b85-42d9-bdf3-f730af80e123",
    "repository_id": "c90131b4-5c7c-4ebc-a1f3-8002d219bfe0",
    "attributed_to": "e1e76369-3121-44c4-abbd-aeadae1a76f2",
    "title": "Void contracts are able to claim gas while they should not be able to",
    "description": "**Description**:\n\nContracts have two gas modes: Void and Claimable. All gas from void contracts will be attributed to sequencer, as admins can claim 100% of it. Gas of Claimable contracts, on the other hand, could be claimed by themselves/governors with rate determined by blast's mechanism. \nThe problem is that void contracts could still claim gas as there is no check to prevent them from doing so.\nThis could lead to small loss of funds for the protocol.\n\n**Recommendation**:\nAdding a check which will revert when void contracts are trying to claim gas in claim() function",
    "status": "withdrawn",
    "severity": "medium",
    "likelihood": "high",
    "impact": "medium",
    "created_by": "cbfc21bc-63d4-45e6-b346-510692c03664",
    "created_at": "2024-02-17 05:58:02.242556+00",
    "number": 385,
    "last_updated_by": "cbfc21bc-63d4-45e6-b346-510692c03664",
    "fixed_by": "{}",
    "duplicate_of": null,
    "points": null,
    "quality": null
  },
  {
    "id": "00117a11-0759-4abd-9c72-bdca9f50bc6c",
    "repository_id": "8409a0ce-6c21-4cc9-8ef2-bd77ce7425af",
    "attributed_to": "5051fda1-ab4d-438c-ba6f-2e9a97bd57a8",
    "title": "Incorrect documentation of `onlyCuratorOrGuardianRole` modifier",
    "description": "**Description**:\n\nThe comment describing the `onlyCuratorOrGuardianRole` modifier currently states that it reverts if the caller does not have the curator or guardian role. However, this is not entirely accurate as it also does not revert if the caller is the owner.\n\n**Recommendation**:\n\nTo provide an accurate description, update the comment to the following: \"/// @dev Reverts if the caller doesn't have the curator nor the guardian role and is not the owner.\"",
    "status": "new",
    "severity": "informational",
    "likelihood": null,
    "impact": null,
    "created_by": "65d6a7e1-9967-4bf3-9e17-5f9567491bb2",
    "created_at": "2023-11-22 13:31:22.012544+00",
    "number": 47,
    "last_updated_by": "65d6a7e1-9967-4bf3-9e17-5f9567491bb2",
    "fixed_by": "{}",
    "duplicate_of": null,
    "points": null,
    "quality": null
  }
]