QA Report

[c4-bot-9]

See the markdown file with the details of this report here.

[c4-judge]

OpenCoreCH marked the issue as selected for report

[c4-judge]

OpenCoreCH marked the issue as grade-a

[c4-judge]

OpenCoreCH marked the issue as not selected for report

[nnez]

Hi @OpenCoreCH
I have two issues regarding my Low/QA findings:

1.

L-07 Lanlord should only allow to call withdrawtolandlord for approved rental should be a duplicate of #37 because it describes the same exact scenario

However, I think the root cause here is that the function allows withdrawal of unapproved long-term rental. The token owner should be able to reject active long-term reservations as this could be used to free up availability in case of violation on rental agreement.

The token owner should have more authority than the renter in long-term rental because they can't demand a full payment for the total rental period (it doesn't make sense to do so, you don't pay 12 months in advance for renting an apartment for a year). To illustrate my point, if the renter were to miss their payment for three months, they might face an eviction in the real world, Similarly, they must be evicted on the smart contract as well.

2.

L-02 Token owner might frontrun reservation transaction and change cancellation policy in short-term rental should be a duplicate of #35, as it describes the same root cause: a malicious cancellation policy.

The specific nature of the malicious cancellation policy is irrelevant. It could be a large-size vector or a cancellation fee of 100% or more. It would still prevent renter from cancelling their reservation.

I submitted this issue as a Low severity because

1. Token owner can't change their cancellation policy while there are rentals (active or non-active) in their token, therefore, this can only be done on the first rental on the property.
2. This scenario requires a degree of user error, as users should be able to view the cancellation policy before making a reservation. Hence, malicious renters would need to frontrun user transactions to change the cancellation policy.

[thebrittfactor]

For awarding purposes, C4 staff have marked as 2nd place.