Missing two grants payments that are shown in the UI for the Rotki grant.

[LefterisJP]

Describe the bug

In the Rotki app grant there is as of writing this issue 12 contributions but there are only 10 corresponding transfers on-chain. Around ~30 DAI are missing.

Gitcoin grant page UI:

Etherscan UI:

https://etherscan.io/address/0x9531c059098e3d194ff87febb587ab07b30b1306

I compared the contributions to etherscsan one by one to see which ones did not make it. And from what I saw these are the culrprits:

The very first contribution:

Even in the UI there is no etherscan link so can't even say what is the address we should have received funds from.

The third (and biggest contribution):

https://etherscan.io/tx/0xca29bbe0196f671f564d5bce4dcf4c27eb5fab29ff223ce07ba601c9afbfd44a

It seems that this transfer did not make it into the grant when looking at all the addresses the grant received funds from this (and the 0.8333 DAI one without a link) are the only ones missing.

To Reproduce

Not sure. But these 2 transfers did not make it.

Expected behavior

Have the same number of transfers as contributions. Also the amount funded should match what the grant creator has received (minus fees ofcourse).

[markusbkoch]

Not sure about the first one, but the problem with the third one is the same as the one reported in #5723: approve transaction went through, but transfer failed due to insufficient balance.

[LefterisJP]

It seems you are right @markusbkoch. The problem with the second transaction is indeed due to insufficient balance of the user. So I suppose the second transfer is the same issue as #5723.

I would also like to know what happened in the first transfer though.

[markusbkoch]

I assume that's a case of "phantom funding", with the user having signaled support for 6 projects ($5/6 = 0.8333). I have just signaled support for Ethereum ETL to see what the UI looks like, and it matches what you see in that case.
.
So from the description in the link above, I understand Rotki will get the $0.83 at the end of the round.

[LefterisJP]

Hey @markusbkoch thank you for the insight. That could be it. I guess then that this is something that the Gitcoin website can do better so that we don't end up expecting a transfer and wondering what happened.

I would expect it to be shown as "phantom funding", not be counted to the total, and have an explanation of what it is.

[owocki]

thanks guys; we are working on a fix for this internally at gitcoin right now

[LefterisJP]

It seems to have happened again for the Rotki grant @owocki at least 2 times. It would be nice if the solution you guys reach can retroactively fix the interface to display the correct amount funded.

I would not want people to think we got funded XX amount from the community when that amount is actually smaller.

[owocki]

yes; we are on it! @danlipert and @thelostone-mc were rolling back some transactions yesterday, planning on getting the rest tomorrow

[LefterisJP]

Hey @owocki

This also needs to be disallowed, not just roll back transactions. Someone just did it to poor Antiprosynthesis crediting his grant with 1 million DAI: https://gitcoin.co/grants/160/antiprosynth-twitter-account-activity?tab=activity

Here is the approve: https://etherscan.io/tx/0xe83d42ed1d6305ac099adb61929af921fd8ea3ca61a6585c1c6a840d452bfe02

Needless to say that this should be top priority fix during the round as it's an attack on a grant:

• Malicious user approves a huge amount but spends nothing, credits as many grants as he wants to attack
• The CLR matching system goes completely nuts
• The honest users who would like to contribute to these grants are completely put off as they think that the transactions actually happened and the grant creators are now rich.

[owocki]

@danlipert said he deleted the tx entries on the grant for the failed txs

here is a ticket to code up a root cause fix for the malicious input to the frontend. take a look on that ticket and let me know what you think #5762

[danlipert]

@LefterisJP deployed some preventative fixes and some transaction checking code today - we'll stay on the lookout for future fraudulent activity. Thanks for your report

[poma]

Would be cool to trigger matching rescan as antiprosynth still has $64k in matching

[owocki]

@poma done!