Post-Judging QA

[liveactionllama]

1. Please post feedback about specific findings on the relevant issue in this repo.
2. More general feedback for the judge can be shared here.

The judge for this contest is @gzeoneth.

Reminders

• Please keep your comments as fact-based as possible.
• C4 judges have final authority in determining validity and severity.
• You are welcome to start new discussions here!
• Please link to specific issues wherever relevant.

Thank you!

[nevillehuang]

Hi @gzeon-c4 thanks again for your efforts, left a message at #42 for sponsor that you can review.

[gzeon-c4]

looks like its already resolved, let me know if I missed anything

[said017]

Hi @gzeon-c4 , thanks for judging! I have a few comments :

• I don't think Double entry tokens #90 is a valid duplicate of User can steal tokens by using duplicated ERC20 tokens as parameter in NounsDAOLogicV1Fork.quit #102, it talks about Double Entry Tokens (e.g. TUSD) that can be added by the admin function via _setErc20TokensToIncludeInQuit call and the admin/proposer doesn't aware of the consequence, and not the quit attack vector where an attacker can put erc20TokensToInclude duplicated of same tokens inside the array. It has different concerns and It seems more like preventing admin miss config.

• And for If DAO updates forkEscrow before forkThreshold is reached, the user's escrowed Nouns will be lost #56, while the issue is valid, it requires a governance change call of _setForkEscrow via proposal, It means it requires either a lot of malicious governance to pass this proposal or the majority are unaware that this proposal can hurt fork escrower. It also has a whole lifecycle of the proposal that has plenty of time for the escrower to react (by call withdrawFromForkEscrow before the proposal executed), even after the vote passes the threshold, it has a delay time before the execution that is designed so users can react to the proposal that may negatively affect them. So the condition for this to happen requires a majority of voters are malicious and escrower mistakes (not react accordingly). And the loss is also not indefinitely, escrowers and honest voters can also propose to change back the ds.forkEscrow via the _setForkEscrow to rescue the escrowed nouns. Besides that, a lot of things can go wrong by proposing execution/changes that messing around with NounsDAOV3Admin.sol value, but most likely majority will not allow harmful execution.

[gzeon-c4]

#90 thanks, that make a lot of sense, will review judging there

[gzeon-c4]

#56 it would mean if one does not trust the majority, he cannot park his nouns in the escrow to wait for a fork unless he also actively monitor all governance proposals. While there are other thing that can be changed that would also harm the minority, those changes (e.g. remove the list of ERC20 that will be send to the fork) are clearly hostile to the minority with no realistic way to prevent. However, changing the forkEscrow (e.g. for an upgrade) might seems to be benign and it is possible to allow withdrawal from escrow directly to avoid asset being stuck, even if they can be rescued via an upgrade.

2 — Med: Assets not at direct risk, but the function of the protocol or its availability could be impacted, or leak value with a hypothetical attack path with stated assumptions, but external requirements.

It is also important to remember that suggested mitigation does not directly impact judging of severity.

[said017]

I see, I will respect your final decisions, thanks for the answers and discussions!

[said017]

• Hi @gzeon-c4 , I made a comment on The new DAO V3 Proposal consider vote from startBlock, but quorumVotes is still calculated using creation Block's total supply. quorumVotes calculation will not be accurate and handicap to proposal creator. #126

[said017]

Hi @gzeon-c4 , hope you didn't miss my comment on #126 issue.

[Emedudu]

Hi @gzeon-c4 , thanks for your effort
I made a comment on issue 163

[Emedudu]

Hi @gzeon-c4
hope you didn't miss this

[gzeon-c4]

added comment

[Emedudu]

Thanks!
I made another comment🙂