Auction scripts

[ylv-io]

Description

Type of change

• Bug fix
• New feature
• Breaking change
• Dependency changes
• Deployment
• Forge Script
• Code refactor / cleanup
• Documentation or wording changes
• Other

Checklist:

• The diff is legible and has no extraneous changes
• Complex code has been commented, including external interfaces
• Tests have 100% code coverage
• The base branch is either main, or there's a description of how to merge

Issue Resolution

[github-actions]

Slither report

THIS CHECKLIST IS NOT COMPLETE. Use --show-ignored-findings to show all the results.
Summary

• unchecked-transfer (1 results) (High)

unchecked-transfer

Impact: High
Confidence: Medium

• ID-0
  AaveWithdrawWorkflow.withdraw(address,uint256) ignores return value by IERC20(asset).transfer(safe,fee)

kinto-core/src/access/workflows/AaveWithdrawWorkflow.sol

Lines 50 to 64 in 609ebf9

	function withdraw(address asset, uint256 amount) public returns (uint256) {
	address pool = poolAddressProvider.getPool();
	// If amount is max uint256, withdraw all available
	if (amount == type(uint256).max) {
	amount = IERC20(IAavePool(pool).getReserveData(asset).aTokenAddress).balanceOf(address(this));
	}
	// Withdraw from Aave
	IAavePool(pool).withdraw(asset, amount, address(this));
	// Send the fee to the Safe
	uint256 fee = amount * FEE / 1e18;
	IERC20(asset).transfer(safe, fee);
	return amount - fee;
	}

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 89.25%. Comparing base (9f53019) to head (c141d86).

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #345      +/-   ##
==========================================
+ Coverage   89.11%   89.25%   +0.13%     
==========================================
  Files          42       42              
  Lines        2656     2652       -4     
==========================================
  Hits         2367     2367              
+ Misses        289      285       -4     

Files with missing lines	Coverage Δ
src/tokens/bridged/BridgedKinto.sol	95.23% <100.00%> (+15.23%)	⬆️

[rrecuero]

not sure if this logic is correct.

You are assuming people are getting the tokens at their bid price which is incorrect.

For example I bid 30, you bid 30 and the third person bids 10.

I should be getting my tokens at 10 not at 30, so to calculate tokens accumulated you need to use 10 not 30

[rrecuero]

otherwise we are not grabbing the real last bid, we are finishing up earlier than we should

[ylv-io]

It doesn't assume people are getting the tokens at their bid. The first look is only to calculate how many tokens people are willing to buy.

[rrecuero]

but youa re using this to calculate the finalPrice

[rrecuero]

how are you calculating priority? Take into account that within engen, the engen balance matters and then emissaries and then people sorted by their K balance

[ylv-io]

Yeah, calculating priority would be another script, as we have to fetch data for Engen and Balances.

[rrecuero]

this is what I think is incorrect

[rrecuero]

this is like the worst case. Because if I bid $300 for $30, you are only accumulating 10 tokens but in reality maybe you should have accumulated 30

[rrecuero]

so you would run out of tokens earlier

[rrecuero]

That's why I think the loop needs to be over each bid price first, and then over bids. It needs to be a double loop

[ylv-io]

Yeah. I agree. thanks.

[openzeppelin-code]

Auction scripts

Generated at commit: 390507d92d0ec7e270a79fe84c7beb89efb80d6d

🚨 Report Summary

	Severity Level	Results
Contracts	Critical High Medium Low Note Total	4 2 0 12 39 57
Dependencies	Critical High Medium Low Note Total	0 0 0 0 0 0

---

For more details view the full report in OpenZeppelin Code Inspector