QA Report

[code423n4]

1. The logic applied to emit an event of the change of a variable, does not check that the change is to the same value as the current one, it should be omitted to launch a change event if the defined value is the same, otherwise, the dApps could have wrong logics

   • TurboBooster.sol#L39
   • TurboBooster.sol#L61
   • TurboBooster.sol#L83
   • TurboSavior.sol#L80
   • TurboClerk.sol#L41
   • TurboClerk.sol#L75
   • TurboClerk.sol#L93
   • TurboMaster.sol#L73
   • TurboMaster.sol#L93
   • TurboMaster.sol#L114

2. The Auth contract not forced to use a TimeLock so if the admin loss the private keys or these keys are exposed, tokens could be lost. Or it's possible to deny the service because TurboBooster can be frozen and change the owner.

[Joeysantoro]

Ack #1, Dispute #2 because its a configuration consideration that can be manually verified post deploy

[GalloDaSballo]

I believe the sponsor has a track record of disagreeing with superfluous checks

That said they acknowledged finding one which would cause a revert when trying to change the setting to the same value. Personally am ambivalent but because the sponsor acknowledges am happy to agree there.

As for point 2 I have to side with the sponsor unless the code was for a timelock, there are no ways of proving the code will be timelocked hence the finding is not useful.

See discussion: https://github.com/code-423n4/rulebook/issues/7

[GalloDaSballo]

2/10