QA Report

[c4-bot-6]

See the markdown file with the details of this report here.

[c4-judge]

OpenCoreCH marked the issue as grade-b

[CrystallineButterfly]

Hello @OpenCoreCH Thank you for judging, this was my first rust based audit and so I am completely accountable for my assumptions and lack of concrete assertions. So I feel your judging is fair and accurate, I am leaving a comment as I would move to suggest given #16 #17 and #18 have been placed as QA also, would it be fair to suggest, that they can be included as part of my QA report and move this to a grade A? If the value for all my issues is deemed beneficial for codedEstate, that is. I completely respect whatever your conclusion comes to be.

All the best- K42

[OpenCoreCH]

Hi @CrystallineButterfly, thanks for your comment. I have looked at the downgraded issues when judging the report. However, #16 and #17 describe issues where the recommendation would not change anything about the behaviour of the system (as well as 03 in the QA report). It is debatable whether handling these cases gracefully or just accepting the panic is preferable, so I treat this as more or less neutral when judging. For #18, the impact of the current design decision is unfortunately not really explained: "it could open up other security risks if combined with other attack vectors and can be better handled." -> Which security risks if combined with which attack vectors? If these questions were answered, it would be more valuable for a project. Similarly, if there were more issues like L-01 and L-02 which describe things that could really improve the behaviour of the system.

[CrystallineButterfly]

Hey @OpenCoreCH thank you for the reply, my assumptions would more so be of an account compromised giving the user who used approve_all less protection if there account is compromised; so this would be more so a social engineering vector, which wouldn't be in scope as it's the users who would be accountable. So i respect your judgement, and understand these don't provide enough value for the project, it helps me do better in next rust audits 🫡

All the best- K42

[thebrittfactor]

For awarding purposes, C4 staff have marked as 3rd place.