Over-Centralization and Keeper DoS Risks
Single keeper can cancel flows, stall deposits/withdrawals, or manipulate positions. There is no fallback or decentralized process.
Summary
The keeper orchestrates and executes trades. If malicious or inactive, flows get stuck.
The vault can be effectively DoSed or manipulated by a single actor.
Vulnerability Details
flowlogic only permits one action at a time. Keeper can repeatedly callcancelFlow(), halting user operations.No fallback if keeper fails to act.
Impact
Users cannot deposit/withdraw if keeper is uncooperative.
Possibly indefinite blocking or forced liquidations.
Tools Used
Functional and state-machine analysis.
Recommendations
Consider multiple keeper addresses or a time-based fallback.
Add an emergency shutdown or allow users to exit without keeper intervention.
Document the trust model clearly.
Lead Judging Commences
Informational or Gas
Please read the CodeHawks documentation to know which submissions are valid. If you disagree, provide a coded PoC and explain the real likelihood and the detailed impact on the mainnet without any supposition (if, it could, etc) to prove your point.
Suppositions
There is no real proof, concrete root cause, specific impact, or enough details in those submissions. Examples include: "It could happen" without specifying when, "If this impossible case happens," "Unexpected behavior," etc. Make a Proof of Concept (PoC) using external functions and realistic parameters. Do not test only the internal function where you think you found something.
Informational or Gas
Please read the CodeHawks documentation to know which submissions are valid. If you disagree, provide a coded PoC and explain the real likelihood and the detailed impact on the mainnet without any supposition (if, it could, etc) to prove your point.
Suppositions
There is no real proof, concrete root cause, specific impact, or enough details in those submissions. Examples include: "It could happen" without specifying when, "If this impossible case happens," "Unexpected behavior," etc. Make a Proof of Concept (PoC) using external functions and realistic parameters. Do not test only the internal function where you think you found something.
Prize pool breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.