Open code423n4 opened 2 years ago
Some token return void in approve and will revert if the IERC20 interface is used. Consider using OZ's safeApprove https://github.com/code-423n4/2022-05-backd/blob/2a5664d35cde5b036074edef3c1369b984d10010/protocol/contracts/tokenomics/VestedEscrow.sol#L25-L26
IERC20(rewardToken_).approve(msg.sender, type(uint256).max);
WETH address might change if deployed on L2 https://github.com/code-423n4/2022-05-backd/blob/2a5664d35cde5b036074edef3c1369b984d10010/protocol/contracts/tokenomics/FeeBurner.sol#L25-L26
address private constant _WETH = address(0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2); // WETH
Finding is valid, although constructor would fail, would re-contextualize as "you forgot to use safeApprove here"
Finding has merit as non-critical, as hardcoded is always cheap for gas
Low
IERC20.approve might revert for some token
Some token return void in approve and will revert if the IERC20 interface is used. Consider using OZ's safeApprove https://github.com/code-423n4/2022-05-backd/blob/2a5664d35cde5b036074edef3c1369b984d10010/protocol/contracts/tokenomics/VestedEscrow.sol#L25-L26
Hardcoded WETH address
WETH address might change if deployed on L2 https://github.com/code-423n4/2022-05-backd/blob/2a5664d35cde5b036074edef3c1369b984d10010/protocol/contracts/tokenomics/FeeBurner.sol#L25-L26