Post-Judging QA

[liveactionllama]

1. Please post feedback about specific findings on the relevant issue in this repo.
2. More general feedback for the judge can be shared here.

The judge for this contest is @0xean.

Reminders

• Please keep your comments as fact-based as possible.
• C4 judges have final authority in determining validity and severity.
• You are welcome to start new discussions here!
• Please link to specific issues wherever relevant.

Thank you!

[Topmark1]

Kudos to The Judge @0xean for a great Judging
Left a comment at issue #262

[Topmark1]

just left a reply on #262 thanks

[Topmark1]

Thanks for the reply Judge @0xean , left my concluding comment as asked for

[0xean]

thanks, waiting for sponsor comment before calling the QA score final.

[Topmark1]

added a discovery impact pending when sponsor gives thought @0xean

[dontonka]

Thanks @0xean for the solid judging.

Left comments on 116, 191, 236 and 293

[dontonka]

This doesn't qualify for H, and is somewhere between QA and M. With several pre-conditions it is possible for the on-revert functionality to not work correctly as far as I understand it, and if that is the case, M is warranted here.

Also, for my own sake of understanding severity, regarding #191, I don't understand why this doesn't qualify as a High, the negative impact being transaction aborted and user fund loss. Could you kindly help me understand your reasoning?

[0xean]

2 — Med: Assets not at direct risk, but the function of the protocol or its availability could be impacted, or leak value with a hypothetical attack path with stated assumptions, but external requirements.
3 — High: Assets can be stolen/lost/compromised directly (or indirectly if there is a valid attack path that does not have hand-wavy hypotheticals).

Requires that there are CCTX transactions that revert when there is an emergency state inducing a pause (an external requirement). I don't believe this is qualifies assets be stolen/lost/compromised directly.

[dontonka]

When they would pause todo an upgrade (doesn't require to be because of an emergency), the probability would be very high that CCTX are pending (except if the chain is not busy, but that's not the point), and those CCTX that would use the refund mechanism would for sure be user fund loss as it would revert. So from my understanding, that would have qualified as M in normal conditions, something really not working as expected, but since the negative impact is actually user fund loss, I thought that would be considered a High. So you are saying according to the C4 definition, this would not classify as High, even if user fund are lost, because it's not a directly attacked and is because of an action of the admin? Would not this qualify for the indirect path 🤔?

[0xean]

I thought about this one a bit more, since the pause state is meant to be utilized in the course of normal operations (updating the TSS address for example), I think H is actually warranted.

[dontonka]

great.

please if you could remove the unsatisfactory label from that would be appreciated #116.

also #214 should probably be at most partial-50 as only identifiing the panic, which is QA.

[Josephdara]

Hi @0xean , Thanks for the swift judging. Some of my issues were incorrectly judged during the pre-sort stage even though they were properly explained. Please kindly review them

• Direct WETH swap fails due to incompatibility with ZetaTokenConsumerUniV3 & ZetaTokenConsumerPancakeV3 #422 was fully explained with references
• Cross-chain transfers will be broken in the future  #430 involves an issue which will break cross chain transactions in the future. One of the invariants mentioned.
• Users can send messages using the ZetaConnectorZEVM while spending zero ZETA.  #442
• ZetaConnectorZEVM cannot receive messages.  #453
• QA Report #463 Is the QA report, which is of a higher level than alot of the grade-b issue, with actual issues rather than bot reports.

[0xean]

All of these have been reviewed, waiting for sponsor comment on #422

[Josephdara]

Hi @0xean
I noticed that my QA L07 is a duplicate of #498
Please give it a look

[Josephdara]

I apologize for pointing this out late as this is quite late in the judging process. I just want you opinion
Thanks alot

[zhaojio]

Hi @0xean , Thanks for the judging.
Left comments on #217 #218

[zhaojio]

Also left a comment on #215

[zhaojio]

and left a comment on #245

[zhaojio]

recommented #215 #217

[0xean]

all of these have been reviewed and addressed.

[zhaojio]

thanks for review, left a reply in #215

[Nabeel-javaid]

left a comment on #152

[0xean]

reviewed and finalized.

[ciphermarco]

Hi, @0xean. I've left comments for your consideration in the following issues:

• Denial-of-Service Through UTXOs Flooding #546 (comment)
• The malicious observer/node can use the voting function to conduct a DoS attack on ZetaChain #223 (comment)
• Ballot Creator Must Not Be Allowed to Vote Against the Observation #539 (comment)
• AddBlockHeader Cannot Cope with Reorgs #542 (comment)

Thank you for judging and spending time to re-consider some of my issues.

[0xean]

thanks, all of these have been reviewed and/or waiting for sponsor comment.

[ciphermarco]

Thank you for taking the time and attention with your careful judging and review, @0xean.

[Bauchibred]

Hi @0xean, thanks for judging, left some comments on #351, #318 & #359.

[0xean]

All of these have been responded to and finalized.

[k4zanmalay]

Hey @0xean, I left some comments in #66 and #57. Thanks in advance!

[0xean]

both have been reviewed.

[k4zanmalay]

@0xean left a reply in #66

[flowercrimson]

Hey @0xean, Thanks for judging! I left comments in #563.

[0xean]

thanks, responded and waiting for sponsor comment to finalize.

[ZanyBonzy]

[0xean]

Going to stick with the lookouts scoring of this report.

[berndartmueller]

Hey @0xean! Thanks for your efforts!

I've left a few comments in the following submissions and would appreciate a second look!

• EVM RPC errors may lead to missed inbound transactions #397
• A single malicious observer can fill the block space with MsgGasPriceVoter messages without proper gas compensation resulting in griefing blocks #398
• The Sender of an outbound cctx originating from the zEVM is potentially set to an incorrect sender address resulting in lost assets during a refund #407

Thanks a lot!

[0xean]

all of these have been reviewed.

[iFrostizz]

GM @0xean , thanks for the judging.
Please see the few comments I left:

• Logs not processing because of panics #573 (comment)
• Missing Validations in the Tx-Tracker Can Drain The Protocol #574 (comment)
• RCE & DoS Through the Stdout in ZetaVisor #567 (comment)
• JSON-RPC DoS through Websockets #566 (comment)

[0xean]

all of these have been reviewed.

[QiuhaoLi]

@0xean Hi, thanks for the review. I added a comment on #484, could you take a look?

[yuliyu123]

Hi @0xean, I left a comment in #469, pls have a look, thanks.

[0xean]

The QA period has already been closed prior to your message.

[goheesheng]

Hi @0xean, I left comment at #142, #107 , #99, #85, #52

[0xean]

https://discord.com/channels/810916927919620096/1195048936709300275/1195049005856596068 <- please see here. Deadline has pased.

[goheesheng]

Yup, I saw wrongly and was 12th. There isn't a work around to check my questions?

[0xean]

They will remain as judged but we can ask @DadeKuma to add a response to the reasons.

[goheesheng]

Alright, thanks for the help!

[DadeKuma]

I've replied to everything.

[0xean]

All issues have been reviewed and am awaiting sponsor comment to finalize judging. Thank you to everyone who raised a comment during QA