PoolTogether - LootBox and MultipleWinners Strateg
Consensys reviewed PoolTogether (PoolTogether - LootBox and MultipleWinners Strateg) on 1 Nov 2020: 23 findings, 2 critical; none marked fixed.
Report hosted on diligence.security.
Trustblock does not review code.
Findings23
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 2 | 0 | 0 |
| High | 3 | 0 | 0 |
| Medium | 5 | 0 | 0 |
| Low | 13 | 0 | 0 |
CriticalLootBox - Unprotected selfdestruct in proxy implementationOpen
The report gives no description here.
CriticalPeriodicPrizeStrategy - RNG failure can lock user fundsOpen
The report gives no description here.
HighPeriodicPriceStrategy - trustedForwarder can impersonate any msg.senderOpen
The report gives no description here.
HighTicket duplicationOpen
The report gives no description here.
HighUnpredictable behavior for users due to admin front running or general bad timingOpen
The report gives no description here.
MediumLootBox - plunder should disallow plundering to address(0)Open
The report gives no description here.
MediumMultipleWinners - setNumberOfWinners does not enforce count>0Open
The report gives no description here.
MediumPeriodicPriceStrategy - addExternalErc721Award duplicate or invalid tokenIds may block award phaseOpen
The report gives no description here.
MediumPeriodicPrizeStrategy - Token with callback related warnings (ERC777 a.o.)Open
The report gives no description here.
MediumPeriodicPrizeStrategy - unbounded external tokens linked list may be used to force a gas DoSOpen
The report gives no description here.
Show 10 more
LowCheck codesize before adding listenersOpen
The report gives no description here.
LowClean up unused source-units in the repositoryOpen
The report gives no description here.
LowInitialize implementations for proxy contracts and protect initialization methodsOpen
The report gives no description here.
LowLootBox - executeCalls can be misused to relay callsOpen
The report gives no description here.
LowLootBox - transferEther should be internalOpen
The report gives no description here.
LowLootBox - unnecessary payableOpen
The report gives no description here.
LowMultipleWinners - Awards can be guaranteed with a set number of ticketsOpen
The report gives no description here.
LowMultipleWinners - Inconsistent behavior compared to SingleRandomWinnerOpen
The report gives no description here.
LowPeriodicPrizeStrategy - Inconsistent behavior between award-phase modifiers and view functionsOpen
The report gives no description here.
LowReconsider the use of proxy factories in the system if they are not neededOpen
The report gives no description here.
Show 3 more
LowRework the repository structure and clearly mark which 3rd party contracts have been modifiedOpen
The report gives no description here.
LowStick to clear interface naming conventionsOpen
The report gives no description here.
LowWhere possible, functions should accept a specific contract type rather than address parametersOpen
The report gives no description here.
Contracts in scope
No deployed address is recorded for this audit.
The report names a repository or files. Open the report to see its scope.
Repository and files the report names (5)
- pool/contracts/prize-strategy/multiple-winners/MultipleWinners.sol
- pool/contracts/builders/MultipleWinnersBuilder.sol
- pool/contracts/prize-strategy/multiple-winners/MultipleWinnersProxyFactory.sol
- pool/contracts/prize-strategy/PeriodicPrizeStrategyListener.sol
- pool/contracts/prize-strategy/PeriodicPrizeStrategy.sol
Part of PoolTogether’s security record
PoolTogetherSecurity firm
Consensys41 projects reviewed · 59 reports · latest Oct 2024
See Consensys’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us