Trail of Bits

Numerai

Type

Security review

Client

Numerai

Date

2019-05

Domain

Blockchain

Effort

3 wks

Section

Ethereum/EVM

Trail of Bits's security review of Numerai (May 2019) identified 10 issues: 5 medium, 3 low, and 2 informational.

Findings · 10

  1. 1 createRound in UpgradeDelegate calls delete on a struct containing a mapping Low
  2. 2 Missing return on disableContractUpgradability Low
  3. 3 The Gnosis wallet has incompatible behaviors between wallet implementations regarding data padding Medium
  4. 4 The Gnosis wallet does not check for contract existence and may mislead the user about the transaction's result Medium
  5. 5 Project dependencies contain vulnerabilities Low
  6. 6 Yarn commands can fail and still continue execution Medium
  7. 7 Transactions can occur during the upgrade process Medium
  8. 8 The call function has confusing success logic and comorbid return values Informational
  9. 9 Error logging is disabled for calls to contracts on-chain Medium
  10. 10 Solidity compiler optimizations can be dangerous Informational

Findings extracted from the published report PDF. See the full report below for details and remediation.

Related