Context

OP Labs is offering a 300k USDC side pot to supplement the Fault Proofs Sherlock contest that concluded in May 2024. This side pot will reward a number of issues that fell out of scope of the Fault Proofs contest and brings the total payout for the contest to 500k USDC in line with the original maximum pot size for the Sherlock contest.

Please read this document carefully to determine if you are eligible for the side pot and to understand the process being used to distribute these additional rewards.

Eligibile Reports

Reasoning

OP Labs is rewarding a number of issues that were reported during the FP contest as if (1) the contest included the full FP system in scope and (2) security council mitigations do not exist. Reports that were rewarded in the original contest are not considered here. Low severity issues are considered “no reward” and are not included in this list.

High Severity

1. Game can be resolved before subgame is resolved, subgame bonds locked forever
   • #5, #63, #106, #117, #150, #164, #202, #98, #188
2. Games can be attacked after claim resolution, game bricked forever
   • #148, #168, #78, #143, #92
3. Games can be bricked by creating a sufficient number of subgames
   • #7, #25, #211
4. Subgames can be won at the last second
   • #144, #197, #208

• Subgames can be won when other team has available time
  • #8, #36, #99, #198

1. CWIA can be abused to create a game that cannot be resolved (double proposal)
   • #54, #86, #125, #139, #159, #189, #203, #221

Medium Severity

1. CWIA corruption (but no concrete exploit provided)
   • #108, #83, #115
2. Max game depth bug (requires specific bad configuration)
   • #176, #212
3. Index at depth bug (requires specific bad configuration)
   • #222
4. Leftmost claim bug (incentive compatibility bug)
   • #200
5. CWIA can be abused to create a game that cannot be resolved (4 byte trick)
   • #43

Payout Formula