code-423n4 / 2022-04-jpegd-findings

1 stars 1 forks source link

QA Report #150

Open code423n4 opened 2 years ago

code423n4 commented 2 years ago

Tokens should implement Permit for integrations purposes

Team should consider implementing ERC2612 https://github.com/OpenZeppelin/openzeppelin-contracts/blob/master/contracts/token/ERC20/extensions/draft-ERC20Permit.sol as it enables a lot of powerful integrations where you can skip the approval step and do everything in 1 transaction. It can also simply JPEG UX.

https://github.com/code-423n4/2022-04-jpegd/blob/main/contracts/tokens/StableCoin.sol https://github.com/code-423n4/2022-04-jpegd/blob/main/contracts/tokens/JPEG.sol

Trust placed in DAOs seems highly dangerous and could be avoided

https://github.com/code-423n4/2022-04-jpegd/blob/e72861a9ccb707ced9015166fbded5c97c6991b6/contracts/vaults/FungibleAssetVaultForDAO.sol#L18

Here, why not implementing safeguards for DAOs Fungible Vaults ? Like you could burn borrowed assets on their behalf, or withdraw and do a by hand liquidation with some governance functions