Comments (7)
Hey @Bauchibred, appreciate the in-depth analysis of the QA report and your contribution to the PJQA process! I have evaluated all findings that infer a medium upgrade as follows:
- QA-02: While this is indeed a mistake, I believe a QA (L) severity is appropriate as the off-chain software of zkSync Era relies on events rather than return variables (as a return variable is accessible to the caller whilst events are accessible to all listeners). I will raise this concern with the zkSync Era team for a revisit but will retain a QA (L) ruling for now.
- QA-06: This is invalid as the cumulative
balance
values of the contract are at least equal to thetotalSupply
due to the token being a closed-circuit system (i.e.balances
cannot increase from0
withouttotalSupply
being increased as well) - QA-09: The
Additional Note
item is indeed correct in the sense that regardless of whether this finding is valid, the exhibit cannot be considered as a valid HM due to being out-of-scope. One of the duplicates from that contest is actually mine, and I understand the implications fully, however, I believe they have been adequately covered in the previous contest and this item is out-of-scope. - QA-13: Likewise, this is a valid QA finding from the perspective of additional insight into a past finding but cannot be considered in scope as an HM vulnerability.
- QA-28: I believe a QA (L) severity is fair, and it is impossible to mimic the
extcodecopy
instruction's operation due to zkSync Era's internal structure.
I believe that the present ruling is fair, but will make sure to notify the sponsor for a re-evaluation of QA-02 in case it merits an upgrade. It definitely is a mistake in the code, but I do not believe its ramifications to be impactful as nodes utilize events as highlighted in other exhibits such as #112.
from 2024-03-zksync-findings.
Regarding validity of items in this QA report, per conversation with the judge @alex-ppg:
The only clear mistake is QA-06, and the rest are passable NC / L / I recommendations. As such, I confirm that all QA items except for QA-06 are valid.
As such, QA-06 will be excluded from the final audit report.
from 2024-03-zksync-findings.
The first “QA” was considered medium by us!
from 2024-03-zksync-findings.
alex-ppg marked the issue as grade-a
from 2024-03-zksync-findings.
alex-ppg marked the issue as selected for report
from 2024-03-zksync-findings.
This submission was graded as the best due to exceeding the 50% accuracy threshold whilst containing valid and thoroughly elaborated findings in an easily digestible format. To note, the first QA finding will be upgraded accordingly once judging concludes and this exhibit is split into a second one as a duplicate of #97.
from 2024-03-zksync-findings.
Hi @alex-ppg, thanks for judging the contest, I'd like to ask if it's possible you have any comments in regards to the upgradability of some of the listed borderline low/medium issues, a couple were attached here in the QA report as an attempt on not spamming the judging repo with reports that could end up being finalised as QA, I'd appreciate a quick glance on this borderline issues to see if any could be upgraded.
To ease the re-review, I believe grepping the markdown file with the word
medium
would pinpoint most of these issues, however I'd appreciate re-review as not all have been linked with themedium
word, thanks once again for your time.
from 2024-03-zksync-findings.
Related Issues (20)
- Gas Optimizations HOT 3
- No way to retrieve ETH from the contract: HOT 5
- Large transfers may not work with some ERC20 tokens HOT 4
- Gas Optimizations HOT 3
- `L2StandardERC20.sol` has a flaw in token's reinitialization logic cause after a while the governor would not be able to update the token's metadata HOT 4
- QA Report HOT 2
- Gas Optimizations HOT 3
- Gas Optimizations HOT 3
- Gas Optimizations HOT 5
- Gas Optimizations HOT 5
- Centralization risks around `Governance.sol` HOT 7
- Deviational use of `useNearCallPanic` while querying `mintEther()` in `ZKSYNC_NEAR_CALL_executeL1Tx()` could cost users all their gas for the execution HOT 4
- Gas Optimizations HOT 3
- QA Report HOT 2
- QA Report HOT 2
- QA Report HOT 2
- QA Report HOT 2
- Upgraded Q -> 2 from #122 [1714762888728] HOT 2
- Upgraded Q -> 2 from #60 [1714762986225] HOT 2
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from 2024-03-zksync-findings.