Brief audit of `vault.ride` @ `feture/v2`

[deemru]

• [x] #9
• [x] MEDIUM: no argument check can lead to contract admin lock: https://github.com/Tsunami-Exchange/tsunami-contracts/blob/fd62040d914202f817416605ac8cff6e32ce04f4/contracts/ride/vault.ride#L282
• [x] LOW: admin lock still possible because of implicit admin setting (admin key not used at all): https://github.com/Tsunami-Exchange/tsunami-contracts/blob/fd62040d914202f817416605ac8cff6e32ce04f4/contracts/ride/vault.ride#L611
• [x] LOW: payments count not checked == 1: https://github.com/Tsunami-Exchange/tsunami-contracts/blob/fd62040d914202f817416605ac8cff6e32ce04f4/contracts/ride/vault.ride#L291 https://github.com/Tsunami-Exchange/tsunami-contracts/blob/fd62040d914202f817416605ac8cff6e32ce04f4/contracts/ride/vault.ride#L428 https://github.com/Tsunami-Exchange/tsunami-contracts/blob/fd62040d914202f817416605ac8cff6e32ce04f4/contracts/ride/vault.ride#L460 https://github.com/Tsunami-Exchange/tsunami-contracts/blob/fd62040d914202f817416605ac8cff6e32ce04f4/contracts/ride/vault.ride#L556
• [ ] LOW: its 8 complexity: https://github.com/Tsunami-Exchange/tsunami-contracts/blob/fd62040d914202f817416605ac8cff6e32ce04f4/contracts/ride/vault.ride#L56
• [ ] LOW: we never checked quote asset is 6 decimals but have that: https://github.com/Tsunami-Exchange/tsunami-contracts/blob/fd62040d914202f817416605ac8cff6e32ce04f4/contracts/ride/vault.ride#L62-L63
• [ ] LOW: it is maybe hard to unstake the exact maximum available for a period (withdrawLimitLeft), consider to use -1 or alternative: https://github.com/Tsunami-Exchange/tsunami-contracts/blob/fd62040d914202f817416605ac8cff6e32ce04f4/contracts/ride/vault.ride#L342
• [ ] LOW: _reward / DURATION * DURATION can be less than _reward, consider to return this dust or use assetBalance() to account the dust in next rounds: https://github.com/Tsunami-Exchange/tsunami-contracts/blob/fd62040d914202f817416605ac8cff6e32ce04f4/contracts/ride/vault.ride#L567 https://github.com/Tsunami-Exchange/tsunami-contracts/blob/fd62040d914202f817416605ac8cff6e32ce04f4/contracts/ride/vault.ride#L571
• [ ] LOW: small _reward can extend leftover to full duration: https://github.com/Tsunami-Exchange/tsunami-contracts/blob/fd62040d914202f817416605ac8cff6e32ce04f4/contracts/ride/vault.ride#L571
• [x] HIGH: withdrawLocked() but can withdraw fromFree actually with no limit at all: https://github.com/Tsunami-Exchange/tsunami-contracts/blob/fd62040d914202f817416605ac8cff6e32ce04f4/contracts/ride/vault.ride#L535
• [ ] HIGH: no limits on _amount looks dangerous: https://github.com/Tsunami-Exchange/tsunami-contracts/blob/fd62040d914202f817416605ac8cff6e32ce04f4/contracts/ride/vault.ride#L482
• [x] #8
• [ ] LOW: duplicate of computeNewRate(): https://github.com/Tsunami-Exchange/tsunami-contracts/blob/fd62040d914202f817416605ac8cff6e32ce04f4/contracts/ride/vault.ride#L439-L443
• [ ] HIGH: we assume its grow? https://github.com/Tsunami-Exchange/tsunami-contracts/blob/fd62040d914202f817416605ac8cff6e32ce04f4/contracts/ride/vault.ride#L591-L592 but rate() can definitely go down at exchangeFreeAndLocked() and withdrawLocked()
• [ ] LOW: updateReward() second argument is always 0: https://github.com/Tsunami-Exchange/tsunami-contracts/blob/fd62040d914202f817416605ac8cff6e32ce04f4/contracts/ride/vault.ride#L147
• [ ] MEDIUM: diff may be less than expected because of low rewardRate() vs. big totalSupply() when call every block: https://github.com/Tsunami-Exchange/tsunami-contracts/blob/fd62040d914202f817416605ac8cff6e32ce04f4/contracts/ride/vault.ride#L137