Closing out Sukukfi: call-sequence bugs and self-transfers that inflate a balance
We finished the Sukukfi contest on Code4rena, unfortunately we were starting to understand how it all works but we ran out of time, better luck next time! 0xfirefist audited only one of the in-scope contracts and still came up with 2 submissions. Many new things learned, the base is set! Onto the next one!
Lesson Summary:
- Do awkward things with the 3-step flows. Think through different scenarios and call sequences, and see if anything breaks.
- Only walk a specific flow once you know the in-scope contracts, that is, once you understand them to a decent level.
- ERC20 transfer(update) can hide a bug if the update function isn't using storage, but memory - only the last change happens, previous are ignored. So must check if self transfers can inflate balance.