Post-Judging QA

[thebrittfactor]

1. Please post feedback about specific findings on the relevant issue in this repo.
2. Post a comment in this discussion linking to all findings you've commented on, along with any general feedback for the judge.

The judge for this contest is @GalloDaSballo.

Both the Validation repo and the Findings repo will be open to wardens with the SR role, for the purposes of post-judging QA.

• All post-judging QA requests must be posted in this Github Discussion in the findings repo.
• QA and Gas reports closed by Validators (i.e. not added to the findings repo) are NOT eligible.

Reminders

• Please keep your comments as fact-based as possible.
• C4 judges have final authority in determining validity and severity.
• Please link to specific issues and don't try to start discussions here.
• Please familiarize yourselves with our Good Citizen Policy.

Thank you!

[DemoreXTess]

Hello @GalloDaSballo ,

Thank you for judging.
I kindly left my comments to #17, #54, #20, #2

[chaoticpunk]

@GalloDaSballo @ElliotFriedman
Please review this question, thanks.
This is obviously a valid question, msg.sender == address(this) is an invalid code
code-423n4/2024-10-kleidi-validation#110
code-423n4/2024-10-kleidi-validation#67
https://github.com/code-423n4/2024-10-kleidi/blob/main/src/Timelock.sol#L344-L349

[GalloDaSballo]

This seems to come from an incorrect assumption around the code
The timelock must call itself so that those operations enforce a delay

[chaoticpunk]

This seems to come from an incorrect assumption around the code The timelock must call itself so that those operations enforce a delay

Thank you for your reply. I think this is a mistake. Please look at the code carefully. Under the restriction of the onlyTimelock modifier, no address can call the function modified by onlyTimelock, because msg.sender == address(this) is impossible to call successfully. It can only be assumed in the test. Who can call the function modified by onlyTimelock when this code is deployed to the main network?

[gesha17]

Hello @GalloDaSballo,

Thanks for judging. I left comments on both #24 and #5.

Edit: Also left a comment on #6

[GalloDaSballo]

Thank you for your comments

[10xhash]

Hey @GalloDaSballo

Can you please check #9 (comment)

[GalloDaSballo]

Thank you for your comments

[HollaDieWaldfee100]

Hey @GalloDaSballo ,

thanks for the quick judging.
I have helped the warden KlosMitSoss for this contest, so I'm checking the findings on his behalf.

Left three comments:

• UpdateExpirattionPeriod() cannot be execute when the newExpirationPeriod is less than currentExpirationPeriod. #9, agree with comment that Hash has raised and would like to point out that our dupe should also be valid with the same argument (Legitimate proposal might be unable to call updateExpirationPeriod() due to _afterCall() validation #42)
• Validation finding Wrench attack resistance does not provide the advertised security guarantees 2024-10-kleidi-validation#137, which I believe points to a valid issue in the protocol safety mechanism, showing that the intended wrench attack resistance is not achieved, regardless of the configuration.
• Protection against malicious recovery spells is not sufficient in case of multiple recovery spells #14, provided new arguments why it should be valid and can't be discounted.

Also would like to point out that QA report #61 does not seem to be the report that provides the most value. Perhaps there was a problem with grading?

[GalloDaSballo]

Thank you for your comments

Can you please point me to a QA that you believe has a better signal to noise ratio?

[HollaDieWaldfee100]

You might also count reports that were downgraded to QA but reported as H/M, so I don't want to say your judgement is wrong for sure. Also I am of course biased toward our own report, but these three seem to be more valuable from a quick check:
https://github.com/code-423n4/2024-10-kleidi-findings/blob/main/data/KlosMitSoss-Q.md
https://github.com/code-423n4/2024-10-kleidi-findings/blob/main/data/Sathish9098-Q.md
https://github.com/code-423n4/2024-10-kleidi-findings/blob/main/data/Guardians-Q.md

[ABDuullahi]

Hey @GalloDaSballo, great effort here.

have left a comment here .

[GalloDaSballo]

Thank you for your comment

[GalloDaSballo]

Am going to raise the severity of #9 to Med

If you have a duplicate, please link it here

[HollaDieWaldfee100]

#42

[sathishpic22]

Hi @GalloDaSballo

Thanks for judging. Please check my comments on issue : #59

[ZanyBonzy]

Hi @GalloDaSballo
Left comments here and here. Would appreciate you taking a second look. Thanks for the work.