QA Report

[code423n4]

Issue 1 (Low) - Starting time check should be inclusive

https://github.com/code-423n4/2022-04-badger-citadel/blob/18f8c392b6fc303fe95602eba6303725023e53da/src/SupplySchedule.sol#L184

The require statement should include the globalStartTimestamp. > should be changed to >=

Issue 2 (Low) - Front-runnable initializers

There are several initialize() functions that can be frontrun, requiring redeployment. Consider adding simple access control to these functions.

https://github.com/code-423n4/2022-04-badger-citadel/blob/18f8c392b6fc303fe95602eba6303725023e53da/src/CitadelToken.sol#L22-L29

https://github.com/code-423n4/2022-04-badger-citadel/blob/18f8c392b6fc303fe95602eba6303725023e53da/src/SupplySchedule.sol#L43-L46

https://github.com/code-423n4/2022-04-badger-citadel/blob/18f8c392b6fc303fe95602eba6303725023e53da/src/SupplySchedule.sol#L43-L46

Issue 3 (Low)- Floating Pragma

A single contract contains a floating pragma. It is recommended to deploy all contracts with a single, specific compiler version to reduce the risk of compiler-specific bugs and contracts deployed with different versions. In the case of the forked contacts, I recommend deploying with the exact version that the current live versions were deployed with.

https://github.com/code-423n4/2022-04-badger-citadel/blob/18f8c392b6fc303fe95602eba6303725023e53da/src/CitadelToken.sol#L2

Issue 4 (Low) - Code Consistency: Use of Days vs Seconds

In one contract, Days is used. In another 86400 seconds is used. For consistency, consider switching to a single method.

https://github.com/code-423n4/2022-04-badger-citadel/blob/18f8c392b6fc303fe95602eba6303725023e53da/src/StakedCitadelVester.sol#L34

https://github.com/code-423n4/2022-04-badger-citadel/blob/18f8c392b6fc303fe95602eba6303725023e53da/src/SupplySchedule.sol#L25

Issue 5 (Low)- Unnecessary parameter

https://github.com/code-423n4/2022-04-badger-citadel/blob/18f8c392b6fc303fe95602eba6303725023e53da/src/KnightingRound.sol#L209

The tokenOutAmount_ parameter is not used. Instead it is always set in the function.

Issue 6 (Low) - CEI: Move state changes to after token transfer

https://github.com/code-423n4/2022-04-badger-citadel/blob/18f8c392b6fc303fe95602eba6303725023e53da/src/KnightingRound.sol#L193-L199

Though no risk of reentrancy, it's a good practice to move all state changes to after the token is transferred.

Issue 7 (Non-critical) - Use all caps for constant

https://github.com/code-423n4/2022-04-badger-citadel/blob/18f8c392b6fc303fe95602eba6303725023e53da/src/SupplySchedule.sol#L25

Issue 8 (Non-critical) - _pool parameter should be renamed _poolSize

https://github.com/code-423n4/2022-04-badger-citadel/blob/18f8c392b6fc303fe95602eba6303725023e53da/src/StakedCitadel.sol#L880

_pool sounds like it's referring to the pool id.

Issue 9 (Non-critical) - Typo in comment

https://github.com/code-423n4/2022-04-badger-citadel/blob/18f8c392b6fc303fe95602eba6303725023e53da/src/Funding.sol#L333