Submitted by indijanc
Project.sol#L219
Project.sol#L655
Project.sol#L807
A malicious delegated contractor can add a huge number of tasks (or one task with a huge cost). This would then pose problems in allocateFunds() as tasks could not be funded. Builder could remove delegation for the contractor but couldnt replace the contractor and so couldnt remove the malicious contractor. The contractor is required to sign various state changes in Project.sol. A delegated contractor can also for example complete tasks which results in transferring funds to subcontractors.
This sounds very problematic and would be critical, but reading through the documentation and the code, Im assuming there is certain trust incorporated and required for the system to work. Hence Im assuming the system considers a delegated contractor is trustworthy as is the builder. So while the impact may be big I consider the likelihood quite small.
When a contractor is delegated, various operations only need his signature.
Project.sol L807
Visual Studio Code
Theres a couple of improvements you could consider:
parv3213 (Rigor) acknowledged, but disagreed with severity
Jack the Pug (judge) commented:
