-
Notifications
You must be signed in to change notification settings - Fork 54
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
- Loading branch information
Showing
14 changed files
with
6,756 additions
and
408 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,176 @@ | ||
| {| class="wikitable" | ||
| |- | ||
| ! 001 | ||
| ! 002 | ||
| ! 003 | ||
| ! 004 | ||
| ! 005 | ||
| |- | ||
| | Market Attacks | ||
| | Economic Attack | ||
| | Off-Chain | ||
| | On-Chain | ||
| | Solidity | ||
| |- | ||
| | Front-Running | ||
| | In Arrears liability | ||
| | Price Feed | ||
| | Timestamp Dependence | ||
| | Integer Overflow and Underflow | ||
| |- | ||
| | Coordinated Attack | ||
| | Insufficient gas griefing | ||
| | Quote Stuffing | ||
| | Admin Key | ||
| | DoS with (Unexpected) revert | ||
| |- | ||
| | Liquidity Pocket | ||
| | Token Inflation | ||
| | Spoofing | ||
| | Timelock | ||
| | DoS with Block Gas Limit | ||
| |- | ||
| | Quote Stuffing | ||
| | Circulating Supply Attack | ||
| | Credential Access | ||
| | Lateral Movements | ||
| | Arithmetic Over/Under Flows | ||
| |- | ||
| | Wash Trading | ||
| | Gas Griefing (DoS) | ||
| | Reentrancy | ||
| | Multi-Sig Keys | ||
| | Forcibly Sending Ether to a Contract | ||
| |- | ||
| | Ramping The Market | ||
| | Network Congestion (uDoS) | ||
| | Privilage Esclation | ||
| | Miner Cartel | ||
| | Delegatecall | ||
| |- | ||
| | Cornering The Market | ||
| | Liquidity Squeeze | ||
| | Credential Access | ||
| | Finality | ||
| | Entropy Illusion | ||
| |- | ||
| | Churning | ||
| | Governance Cartels | ||
| | Encryption Protections | ||
| | Honeypot | ||
| | Short Address/Parameter Attack | ||
| |- | ||
| | Flash Loans | ||
| | Interlocking Directorate | ||
| | Phishing | ||
| | Red Queen | ||
| | Uninitialised Storage Pointers | ||
| |- | ||
| | Aggregated Transactions | ||
| | Governance Attack | ||
| | Unicode Exploits | ||
| | Sole block synchronization | ||
| | Floating Points and Numerical Precision | ||
| |- | ||
| | Bulge Bracket Transactions | ||
| | Slippage Exploit | ||
| | API | ||
| | Transaction Pool | ||
| | Right-To-Left-Override control character (U+202E) | ||
| |- | ||
| | Layering | ||
| | Safety Check Exploits | ||
| | DNS Attacks | ||
| | Performance Fee Minting | ||
| | Delegatecall to Untrusted Callee | ||
| |- | ||
| | Spoofing | ||
| | Circulating Supply Dump | ||
| | Transaction Pool | ||
| | Front-Running | ||
| | Requirement Violation | ||
| |- | ||
| | Order Book | ||
| | Flash "Straddle" | ||
| | Checksum Address | ||
| | Sandwhiching | ||
| | Shadowing State Variables | ||
| |- | ||
| | Market Index Calculation Attack | ||
| | Structuring | ||
| | Siphon Funds | ||
| | Second System Effector | ||
| | Transaction Order Dependence | ||
| |- | ||
| | Flash Crash | ||
| | Stalking Horse | ||
| | Influencers' | ||
| | Backrunning | ||
| | Assert Violation | ||
| |- | ||
| | Repo | ||
| | Like Asset Price Divergance | ||
| | Synthetic Mint Spread | ||
| | Block Producer Cartel | ||
| | Uninitialized Storage Pointer | ||
| |- | ||
| | Excessive Leverage | ||
| | Reserve Asset Liquidity Manipulation | ||
| | Syscall Exploit | ||
| | Unlimited Permissions on Token Approval | ||
| | Unprotected Ether Withdrawal | ||
| |- | ||
| | Breaking the "Buck" | ||
| | Stable Reserve Asset Manipulation | ||
| | Container Priv. Esclation | ||
| | Naked Call | ||
| | Floating Pragma | ||
| |- | ||
| | "Fake" News | ||
| | Price Induced Oracle Volatility | ||
| | Keyctl missuse (syscall) | ||
| | Block Constructor Cartel | ||
| | Outdated Compiler Version | ||
| |- | ||
| | Nested Bot | ||
| | Fake Token Trading Pair | ||
| | Supply Chain Dependency | ||
| | MaliciousAirdrop | ||
| | Function Default Visibility | ||
| |- | ||
| | Audience of Bots | ||
| | Volume Manipulation by re-circulating flashloan | ||
| | Compiled output destructuring const values | ||
| | Oracle HALT by MultiSig | ||
| | msg.sender | ||
| |- | ||
| | Arb. Exploit | ||
| | Persistant de-peg instability | ||
| | Browser in the Browser attack | ||
| | Ex Ante Reorg | ||
| | Wallet Balance | ||
| |- | ||
| | Cascading Loan Failure | ||
| | Unexpected Fee on Transfer | ||
| | Man in the Blotter | ||
| | Ex Post Reorg | ||
| | Compiler Optimizer not Optimizing | ||
| |- | ||
| | | ||
| | | ||
| | BGP Routing | ||
| | Nonstandard Proxy Implementation | ||
| | Math operations differ in certain pragmas | ||
| |- | ||
| | | ||
| | | ||
| | IP4/IP6 misconfiguration | ||
| | Tyranny of the Majority | ||
| | Uninitialized Contract | ||
| |- | ||
| | | ||
| | | ||
| | | ||
| | | ||
| | | ||
| |} |
File renamed without changes
57 changes: 57 additions & 0 deletions
57
libtx/0x093ceccd651e32c5a636d9b179d286568dff92cdf6fe07c1b2b06c5e8404fcd8.puml
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,57 @@ | ||
| @startuml | ||
| title 0x093ceccd651e32c5a636d9b179d286568dff92cdf6fe07c1b2b06c5e8404fcd8 | ||
| caption Tue, 29 Jun 2021 00:13:32 GMT | ||
| participant "0x8169..9806" as 81699806 | ||
| participant "0xc0da..6529" as c0da6529 <<GovernorBravoDelegator>> | ||
| participant "0xaaaa..e378" as aaaae378 <<GovernorBravoDelegate>> | ||
| participant "0xc00e..6888" as c00e6888 <<Compound (COMP)>><<Comp>> | ||
|
|
||
| note over 81699806 | ||
| Nonce: 29 | ||
| Gas Price: 10.0 Gwei | ||
| Gas Limit: 682,020 | ||
| Gas Used: 539,378 | ||
| Tx Fee: 0.005 ETH | ||
| end note | ||
|
|
||
| 81699806 --> c0da6529: propose(\ntargets: [\n 0: 0x3d98..Cd3B,\n 1: 0x7544..938f],\nvalues: [\n 0: 0,\n 1: 0],\nsignatures: [\n 0: _setPendingImplementation(address),\n 1: _become(address)],\ncalldatas: [\n 0: 0x0..075442ac771a7243433e033f3f8eab2631e22938f,\n 1: 0x0..03d9819210a31b4961b30ef54be2aed79b9c9cd3b],\ndescription: # Close Deprecated Markets, Gas Savings | ||
| This proposal is a patch, developed by Compound Labs, which updates the Comptroller implementation contract. | ||
|
|
||
| ### Changelog | ||
|
|
||
| The `claimComp` function has been optimized to significantly reduce the gas cost of claiming COMP across multiple markets at once, by combining all rewards into a single transfer. | ||
|
|
||
| Markets with a 0% Collateral Factor, 100% Reserve Factor, and Borrowing Paused are inferred to be *deprecated* by the Comptroller, and allowed to be completely liquidated. This allows the closure of all outstanding borrows and the removal of reserves in deprecated markets including SAI, REP, and future migrations. | ||
|
|
||
| ### Development | ||
|
|
||
| This patch was developed publicly, coupled with completed scenario analysis. In addition to the Compound Labs bug bounty program, a secondary bug bounty was offered through [Immunefi](https://immunefi.com/bounty/compound/). | ||
|
|
||
| [Discussion](https://www.comp.xyz/t/safety-and-gas-patches/1723) | ||
| )\n497,426 gas | ||
| activate c0da6529 | ||
| c0da6529 ->> aaaae378: propose(\ntargets: [\n 0: 0x3d98..Cd3B,\n 1: 0x7544..938f],\nvalues: [\n 0: 0,\n 1: 0],\nsignatures: [\n 0: _setPendingImplementation(address),\n 1: _become(address)],\ncalldatas: [\n 0: 0x0..075442ac771a7243433e033f3f8eab2631e22938f,\n 1: 0x0..03d9819210a31b4961b30ef54be2aed79b9c9cd3b],\ndescription: # Close Deprecated Markets, Gas Savings | ||
| This proposal is a patch, developed by Compound Labs, which updates the Comptroller implementation contract. | ||
|
|
||
| ### Changelog | ||
|
|
||
| The `claimComp` function has been optimized to significantly reduce the gas cost of claiming COMP across multiple markets at once, by combining all rewards into a single transfer. | ||
|
|
||
| Markets with a 0% Collateral Factor, 100% Reserve Factor, and Borrowing Paused are inferred to be *deprecated* by the Comptroller, and allowed to be completely liquidated. This allows the closure of all outstanding borrows and the removal of reserves in deprecated markets including SAI, REP, and future migrations. | ||
|
|
||
| ### Development | ||
|
|
||
| This patch was developed publicly, coupled with completed scenario analysis. In addition to the Compound Labs bug bounty program, a secondary bug bounty was offered through [Immunefi](https://immunefi.com/bounty/compound/). | ||
|
|
||
| [Discussion](https://www.comp.xyz/t/safety-and-gas-patches/1723) | ||
| )\n491,783 gas | ||
| activate aaaae378 #809ECB | ||
| c0da6529 -[#3471CD]> c00e6888: getPriorVotes(\naccount: 0x8169..9806,\nblockNumber: 12,725,698)\n5,652 gas | ||
| activate c00e6888 | ||
| return\n101,000,,024,654,469,732,833,014 | ||
| return | ||
| note right of aaaae378: \n486,131 gas | ||
| return\n50 | ||
| note right of c0da6529: \n5,643 gas | ||
|
|
||
| @endumls |
19 changes: 19 additions & 0 deletions
19
libtx/0x97520e4becbfed796cba76fd9b92770865f2e8abbdf387e7516ab8cac5d55226.puml
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,19 @@ | ||
| @startuml | ||
| title 0x97520e4becbfed796cba76fd9b92770865f2e8abbdf387e7516ab8cac5d55226 | ||
| caption Sat, 05 Mar 2022 21:21:30 GMT | ||
| participant "0x3b0e..4640" as 3b0e4640 | ||
| participant "0x2b00..e015" as 2b00e015 <<Xar (XAR)>> | ||
|
|
||
| note over 3b0e4640 | ||
| Nonce: 6 | ||
| Gas Price: 62.799914669 Gwei | ||
| Gas Limit: 7,738,802 | ||
| Gas Used: 7,738,802 | ||
| Tx Fee: 0.486 ETH | ||
| end note | ||
|
|
||
| 3b0e4640 -> 2b00e015: 0x20152aff\n7,533,426 gas | ||
| activate 2b00e015 | ||
| return | ||
|
|
||
| @endumls |
Oops, something went wrong.