search

code-423n4 / 2022-06-notional-coop-findings

1 stars 1 forks source link

QA Report #234

Open code423n4 opened 2 years ago

code423n4 commented 2 years ago

[L-01] Code vs Comment conflict: ERC20 vs ERC777

Comment indicates that ERC20 tokens are minted for the receiver but the contract inherits from ERC777.

https://github.com/code-423n4/2022-06-notional-coop/blob/6f8c325f604e2576e2fe257b6b57892ca181509a/notional-wrapped-fcash/contracts/wfCashLogic.sol#L97

[L-02] - Front-runnable initializer

The initialize function lacks access control and can be frontrun.

https://github.com/code-423n4/2022-06-notional-coop/blob/6f8c325f604e2576e2fe257b6b57892ca181509a/notional-wrapped-fcash/contracts/wfCashBase.sol#L35

[L-03] Floating pragma and inconsistent compiler versions.

wfCashERC4626.sol contains a floating pragma. The other wfCash contracts are set to version 0.8.11.

https://github.com/code-423n4/2022-06-notional-coop/blob/6f8c325f604e2576e2fe257b6b57892ca181509a/notional-wrapped-fcash/contracts/wfCashERC4626.sol#L2 https://github.com/code-423n4/2022-06-notional-coop/blob/6f8c325f604e2576e2fe257b6b57892ca181509a/notional-wrapped-fcash/contracts/wfCashLogic.sol#L2 https://github.com/code-423n4/2022-06-notional-coop/blob/6f8c325f604e2576e2fe257b6b57892ca181509a/notional-wrapped-fcash/contracts/wfCashBase.sol#L2

[L-04] Use of deprecated SafeApprove()

This function has been deprecated in lieu of safeIncreaseAllowance()

https://github.com/code-423n4/2022-06-notional-coop/blob/6f8c325f604e2576e2fe257b6b57892ca181509a/notional-wrapped-fcash/contracts/wfCashBase.sol#L68 https://github.com/code-423n4/2022-06-notional-coop/blob/6f8c325f604e2576e2fe257b6b57892ca181509a/notional-wrapped-fcash/contracts/wfCashBase.sol#L73