Dora Factory security record

The report gives no description here.

The `min_area` is updated mistakenly. In the `else-if` condition, the `min_area` may not be the current project's `area`. Because the current project's `area` increases at this time, the real `min_area` may come from the previous second smallest project. For example: - Project A has the smallest area at this moment, and its `area` is 10. - Project B is the second smallest project at this moment,, and its `area` is 12. - Someone votes the project A again, and its `area` is 15 now. In this time, the `else-if` condition is met and the `min_area` will be updated to `15`. However, the real `min_area` should be 12, and the `min_area_index` should be the id of project B. ```rust=538 if(area < round.min_area || round.min_area == 0) { round.min_area = area; round.min_area_index = project_id; } else if(round.min_area_index == project_id) { round.min_area = area; }; ``` ```rust=550 if(area < track.min_area || track.min_area == 0) { track.min_area = area; track.min_area_index = project_id; } else if(track.min_area_index == project_id) { track.min_area = area; }; ```

The report gives no description here.

The function `exit()` requires the `_amount` less than the `stakingAmount` of users, which means users cannot withdraw all staked tokens. ```solidity=82 function exit(uint256 _amount) external nonReentrant { User storage u = user[msg.sender]; require(u.stakingAmount > _amount); u.stakingAmount -= _amount; u.exitAmount += _amount; u.exitTime = block.timestamp + EXIT_BUFFER_TIME; emit Exit(msg.sender, _amount); } ``` In the `slashTo`, users on the whitelist cannot withdraw all staked tokens from penalized accounts. ```solidity=143 function slashTo( address _slashed, address _to, uint256 _amount ) external { ... uint256 totalAmount = u.stakingAmount + u.exitAmount; require(_amount < totalAmount); require(slashedAmount[_slashed] + _amount < totalAmount); ... } ```

The variable in the above lines should be named `_reentrancyLock`.

The contract has unlocked compiler version. An unlocked compiler version in the source code of the contract permits the user to compile it at or above a particular version. This, in turn, leads to differences in the generated bytecode between compilations due to different compiler versions. This can lead to an ambiguity when debugging as compiler specific bugs may occur in the codebase that would be hard to identify over a span of multiple compiler versions rather than a specific one.

One or more logic contracts do not protect their initializers. An attacker can call the initializer and assume ownership of the logic contract, whereby she can perform privileged operations that trick unsuspecting users into believing that she is the owner of the upgradeable contract. ```solidity=7 contract BuidlDonation { ``` - `BuidlDonation` is an upgradeable contract that does not protect its initializer. ```solidity=66 function init(IERC20 _token, DoraChecker _checker) external { ``` - `init` is an unprotected initializer function. --- ```solidity=6 contract DoraChecker { ``` - `DoraChecker` is an upgradeable contract that does not protect its initializer. ```solidity=52 function init(IERC20 _token) public { ``` - `init` is an unprotected initializer function.

Please confirm which one of following restrictions is more suitable. - `amount > pow_10_decimals / round.voting_unit` - `amount >= pow_10_decimals / round.voting_unit`

The `round_id` is never changed in the while-loop, so it only needs to be checked once. It would be a waste of gas to check every iteration. ```rust=474 while(i < length) { let project_id = *vector::borrow(&project_ids, i); check_project_id(round_id, project_id); let amount = *vector::borrow(&amounts, i); let data = borrow_global_mut<Data>(@QF); let round = vector::borrow_mut(&mut data.rounds, round_id-1); assert!( round.status == ROUND_STATUS__OK, error::invalid_state(ERR_ROUND_STATUS_NOT_OK) ); ... ```

The `event` module is declared in the `aptos_framework`. However, the module `qf` import `event` from the package `aptos_std` as below. ```rust=13 use aptos_std::event; ```