QA Report - Githubissues

Summary

Low Risk Issues

	Issue	Instances
1	Weight of one being used as zero not documented	1
2	Calls may run out of gas until arrays are reduced in size	2
3	Dust amounts not compensated, even if not using price oracle	1
4	Splits can't be locked once the timestamp passes `type(uint48).max`	1
5	Unsafe use of `transfer()`/`transferFrom()` with `IERC20`	2

Total: 7 instances over 5 issues

Non-critical Issues

	Issue	Instances
1	Confusing variable names	1
2	Return values of `approve()` not checked	1
3	Adding a `return` statement when the function defines a named return variable, is redundant	4
4	Non-assembly method available	1
5	`constant`s should be defined rather than using magic numbers	37
6	Use a more recent version of solidity	1
7	Use a more recent version of solidity	3
8	Use scientific notation (e.g. `1e18`) rather than exponentiation (e.g. `10**18`)	1
9	Constant redefined elsewhere	11
10	Inconsistent spacing in comments	1
11	Lines are too long	49
12	Typos	17
13	File is missing NatSpec	29
14	NatSpec is incomplete	5
15	Event is missing `indexed` fields	34
16	Not using the named return variables anywhere in the function is confusing	6

Total: 201 instances over 16 issues

Low Risk Issues

1. Weight of one being used as zero not documented

The comments and code below say that a weight of one is being used as a weight of zero. If a project is mature, or eventually becomes mature, a weight of one may in fact be a useful weighting, and the project owners will become very confused when they are unable to receive funds with this weighting

There is 1 instance of this issue:

File: contracts/JBFundingCycleStore.sol   #1

467        // A weight of 1 is treated as a weight of 0.
468        // This is to allow a weight of 0 (default) to represent inheriting the discounted weight of the previous funding cycle.
469        _weight = _weight > 0
470          ? (_weight == 1 ? 0 : _weight)
471:         : _deriveWeightFrom(_baseFundingCycle, _start);

https://github.com/jbx-protocol/juice-contracts-v2-code4rena/blob/828bf2f3e719873daa08081cfa0d0a6deaa5ace5/contracts/JBFundingCycleStore.sol#L467-L471

2. Calls may run out of gas until arrays are reduced in size

The examples below are of functions that may revert due to the size of the data they're processing, but no funds are at risk because the arrays can be changed

There are 2 instances of this issue:

File: contracts/JBDirectory.sol   #1

357:     if (isTerminalOf(_projectId, _terminal)) return;

https://github.com/jbx-protocol/juice-contracts-v2-code4rena/blob/828bf2f3e719873daa08081cfa0d0a6deaa5ace5/contracts/JBDirectory.sol#L357

File: contracts/JBDirectory.sol   #2

141:       if (_terminal.acceptsToken(_token, _projectId)) return _terminal;

https://github.com/jbx-protocol/juice-contracts-v2-code4rena/blob/828bf2f3e719873daa08081cfa0d0a6deaa5ace5/contracts/JBDirectory.sol#L141

3. Dust amounts not compensated, even if not using price oracle

If there's a fixed weighting between what the user provides, and what is minted for them, there should be code that tracks partial token amounts, so that later payments are compensated for their prior partial amounts

There is 1 instance of this issue:

File: contracts/JBSingleTokenPaymentTerminalStore.sol   #1

385      uint256 _weightRatio = _amount.currency == _baseWeightCurrency
386        ? 10**_decimals
387        : prices.priceFor(_amount.currency, _baseWeightCurrency, _decimals);
388  
389      // Find the number of tokens to mint, as a fixed point number with as many decimals as `weight` has.
390:     tokenCount = PRBMath.mulDiv(_amount.value, _weight, _weightRatio);

https://github.com/jbx-protocol/juice-contracts-v2-code4rena/blob/828bf2f3e719873daa08081cfa0d0a6deaa5ace5/contracts/JBSingleTokenPaymentTerminalStore.sol#L385-L390

4. Splits can't be locked once the timestamp passes `type(uint48).max`

This behavior isn't documented anywhere, and a project will be confused by this behavior when that time comes (the original developers will be unable to explain it because they'll be dead)

There is 1 instance of this issue:

File: contracts/JBSplitsStore.sol   #1

261:         if (_splits[_i].lockedUntil > type(uint48).max) revert INVALID_LOCKED_UNTIL();

https://github.com/jbx-protocol/juice-contracts-v2-code4rena/blob/828bf2f3e719873daa08081cfa0d0a6deaa5ace5/contracts/JBSplitsStore.sol#L261

5. Unsafe use of `transfer()`/`transferFrom()` with `IERC20`

Some tokens do not implement the ERC20 standard properly but are still accepted by most code that accepts ERC20 tokens. For example Tether (USDT)'s transfer() and transferFrom() functions on L1 do not return booleans as the specification requires, and instead have no return value. When these sorts of tokens are cast to IERC20, their function signatures do not match and therefore the calls made, revert (see this link for a test case). Use OpenZeppelin’s SafeERC20's safeTransfer()/safeTransferFrom() instead

There are 2 instances of this issue:

File: contracts/JBERC20PaymentTerminal.sol   #1

87:         ? IERC20(token).transfer(_to, _amount)

https://github.com/jbx-protocol/juice-contracts-v2-code4rena/tree/828bf2f3e719873daa08081cfa0d0a6deaa5ace5/contracts/JBERC20PaymentTerminal.sol#L87

File: contracts/JBERC20PaymentTerminal.sol   #2

88:         : IERC20(token).transferFrom(_from, _to, _amount);

https://github.com/jbx-protocol/juice-contracts-v2-code4rena/tree/828bf2f3e719873daa08081cfa0d0a6deaa5ace5/contracts/JBERC20PaymentTerminal.sol#L88

Non-critical Issues

1. Confusing variable names

It was well into my review before I realized that 'configuration' means the timestamp at which the configuration is set, not the actual configuration details. It would be helpful to people reading the code to name it something like configTimestamp in all places. Below is one example of many

There is 1 instance of this issue:

File: contracts/JBFundingCycleStore.sol   #1

332:     uint256 _configuration = block.timestamp;

https://github.com/jbx-protocol/juice-contracts-v2-code4rena/blob/828bf2f3e719873daa08081cfa0d0a6deaa5ace5/contracts/JBFundingCycleStore.sol#L332

2. Return values of `approve()` not checked

Not all IERC20 implementations revert() when there's a failure in approve(). The function signature has a boolean return value and they indicate errors that way instead. By not checking the return value, operations that should have marked as failed, may potentially go through without actually approving anything

There is 1 instance of this issue:

File: contracts/JBERC20PaymentTerminal.sol   #1

99:       IERC20(token).approve(_to, _amount);

https://github.com/jbx-protocol/juice-contracts-v2-code4rena/tree/828bf2f3e719873daa08081cfa0d0a6deaa5ace5/contracts/JBERC20PaymentTerminal.sol#L99

3. Adding a `return` statement when the function defines a named return variable, is redundant

There are 4 instances of this issue:

File: contracts/JBFundingCycleStore.sol   #1

152:        if (_isApproved(_projectId, fundingCycle)) return fundingCycle;

https://github.com/jbx-protocol/juice-contracts-v2-code4rena/tree/828bf2f3e719873daa08081cfa0d0a6deaa5ace5/contracts/JBFundingCycleStore.sol#L152

File: contracts/JBFundingCycleStore.sol   #2

553:      if (_fundingCycle.number == 1) return configuration;

https://github.com/jbx-protocol/juice-contracts-v2-code4rena/tree/828bf2f3e719873daa08081cfa0d0a6deaa5ace5/contracts/JBFundingCycleStore.sol#L553

File: contracts/JBFundingCycleStore.sol   #3

716:      if (_baseFundingCycle.discountRate == 0) return weight;

https://github.com/jbx-protocol/juice-contracts-v2-code4rena/tree/828bf2f3e719873daa08081cfa0d0a6deaa5ace5/contracts/JBFundingCycleStore.sol#L716

File: contracts/JBFundingCycleStore.sol   #4

835:      if (_configuration == 0) return fundingCycle;

https://github.com/jbx-protocol/juice-contracts-v2-code4rena/tree/828bf2f3e719873daa08081cfa0d0a6deaa5ace5/contracts/JBFundingCycleStore.sol#L835

4. Non-assembly method available

assembly{ id := chainid() } => uint256 id = block.chainid, assembly { size := extcodesize() } => uint256 size = address().code.length

There is 1 instance of this issue:

File: contracts/JBFundingCycleStore.sol   #1

320:          _size := extcodesize(_ballot) // No contract at the address ?

https://github.com/jbx-protocol/juice-contracts-v2-code4rena/tree/828bf2f3e719873daa08081cfa0d0a6deaa5ace5/contracts/JBFundingCycleStore.sol#L320

5. `constant`s should be defined rather than using magic numbers

Even assembly can benefit from using readable constants instead of hex/numeric literals

There are 37 instances of this issue:

File: contracts/abstract/JBPayoutRedemptionPaymentTerminal.sol

/// @audit 18
209:      uint256 _adjustedOverflow = (decimals == 18)

/// @audit 18
211:        : JBFixedPointNumber.adjustDecimals(_overflow, decimals, 18);

/// @audit 32
1074:             bytes memory _projectMetadata = new bytes(32);

/// @audit 32
1113:             bytes memory _projectMetadata = new bytes(32);

https://github.com/jbx-protocol/juice-contracts-v2-code4rena/tree/828bf2f3e719873daa08081cfa0d0a6deaa5ace5/contracts/abstract/JBPayoutRedemptionPaymentTerminal.sol#L209

File: contracts/JBController.sol

/// @audit 232
166:      return (uint256(uint232(_data)), _data >> 232);

/// @audit 232
194:      return (uint256(uint232(_data)), _data >> 232);

/// @audit 18
948:                18,

/// @audit 232
1037:           (_constraints.distributionLimitCurrency << 232);

/// @audit 232
1045:           (_constraints.overflowAllowanceCurrency << 232);

https://github.com/jbx-protocol/juice-contracts-v2-code4rena/tree/828bf2f3e719873daa08081cfa0d0a6deaa5ace5/contracts/JBController.sol#L166

File: contracts/JBDirectory.sol

/// @audit 8
232:        !uint8(_fundingCycle.metadata >> 8).setControllerAllowed()

/// @audit 8
267:        !uint8(_fundingCycle.metadata >> 8).setTerminalsAllowed()

/// @audit 8
365:        !uint8(_fundingCycle.metadata >> 8).setTerminalsAllowed()

https://github.com/jbx-protocol/juice-contracts-v2-code4rena/tree/828bf2f3e719873daa08081cfa0d0a6deaa5ace5/contracts/JBDirectory.sol#L232

File: contracts/JBETHPaymentTerminal.sol

/// @audit 18
42:         18, // 18 decimals.

https://github.com/jbx-protocol/juice-contracts-v2-code4rena/tree/828bf2f3e719873daa08081cfa0d0a6deaa5ace5/contracts/JBETHPaymentTerminal.sol#L42

File: contracts/JBFundingCycleStore.sol

/// @audit 160
354:        packed |= _data.duration << 160;

/// @audit 224
357:        packed |= _data.discountRate << 224;

/// @audit 88
516:      packed |= _basedOn << 88;

/// @audit 144
519:      packed |= _start << 144;

/// @audit 200
522:      packed |= _number << 200;

/// @audit 88
844:      fundingCycle.basedOn = uint256(uint56(_packedIntrinsicProperties >> 88));

/// @audit 144
846:      fundingCycle.start = uint256(uint56(_packedIntrinsicProperties >> 144));

/// @audit 200
848:      fundingCycle.number = uint256(uint56(_packedIntrinsicProperties >> 200));

/// @audit 160
855:      fundingCycle.duration = uint256(uint64(_packedUserProperties >> 160));

/// @audit 224
857:      fundingCycle.discountRate = uint256(uint32(_packedUserProperties >> 224));

https://github.com/jbx-protocol/juice-contracts-v2-code4rena/tree/828bf2f3e719873daa08081cfa0d0a6deaa5ace5/contracts/JBFundingCycleStore.sol#L354

File: contracts/JBOperatorStore.sol

/// @audit 255
63:       if (_permissionIndex > 255) revert PERMISSION_INDEX_OUT_OF_BOUNDS();

/// @audit 255
88:         if (_permissionIndex > 255) revert PERMISSION_INDEX_OUT_OF_BOUNDS();

/// @audit 255
168:        if (_index > 255) revert PERMISSION_INDEX_OUT_OF_BOUNDS();

https://github.com/jbx-protocol/juice-contracts-v2-code4rena/tree/828bf2f3e719873daa08081cfa0d0a6deaa5ace5/contracts/JBOperatorStore.sol#L63

File: contracts/JBSingleTokenPaymentTerminalStore.sol

/// @audit 18
868:        : PRBMath.mulDiv(_ethOverflow, 10**18, prices.priceFor(JBCurrencies.ETH, _currency, 18));

/// @audit 18
868:        : PRBMath.mulDiv(_ethOverflow, 10**18, prices.priceFor(JBCurrencies.ETH, _currency, 18));

/// @audit 18
872:        (_decimals == 18)

/// @audit 18
874:          : JBFixedPointNumber.adjustDecimals(_totalOverflow18Decimal, 18, _decimals);

https://github.com/jbx-protocol/juice-contracts-v2-code4rena/tree/828bf2f3e719873daa08081cfa0d0a6deaa5ace5/contracts/JBSingleTokenPaymentTerminalStore.sol#L868

File: contracts/JBSplitsStore.sol

/// @audit 34
251:        _packedSplitParts1 |= _splits[_i].projectId << 34;

/// @audit 90
253:        _packedSplitParts1 |= uint256(uint160(address(_splits[_i].beneficiary))) << 90;

/// @audit 48
266:          _packedSplitParts2 |= uint256(uint160(address(_splits[_i].allocator))) << 48;

/// @audit 34
318:        _split.projectId = uint256(uint56(_packedSplitPart1 >> 34));

/// @audit 90
320:        _split.beneficiary = payable(address(uint160(_packedSplitPart1 >> 90)));

/// @audit 48
330:          _split.allocator = IJBSplitAllocator(address(uint160(_packedSplitPart2 >> 48)));

https://github.com/jbx-protocol/juice-contracts-v2-code4rena/tree/828bf2f3e719873daa08081cfa0d0a6deaa5ace5/contracts/JBSplitsStore.sol#L251

File: contracts/JBTokenStore.sol

/// @audit 18
249:      if (_token != IJBToken(address(0)) && _token.decimals() != 18)

https://github.com/jbx-protocol/juice-contracts-v2-code4rena/tree/828bf2f3e719873daa08081cfa0d0a6deaa5ace5/contracts/JBTokenStore.sol#L249

6. Use a more recent version of solidity

Use a solidity version of at least 0.8.12 to get string.concat() to be used instead of abi.encodePacked(<str>,<str>)

There is 1 instance of this issue:

File: contracts/abstract/JBPayoutRedemptionPaymentTerminal.sol   #1

2:    pragma solidity 0.8.6;

https://github.com/jbx-protocol/juice-contracts-v2-code4rena/tree/828bf2f3e719873daa08081cfa0d0a6deaa5ace5/contracts/abstract/JBPayoutRedemptionPaymentTerminal.sol#L2

7. Use a more recent version of solidity

Use a solidity version of at least 0.8.13 to get the ability to use using for with a list of free functions

There are 3 instances of this issue:

File: contracts/JBController.sol   #1

2:    pragma solidity 0.8.6;

https://github.com/jbx-protocol/juice-contracts-v2-code4rena/tree/828bf2f3e719873daa08081cfa0d0a6deaa5ace5/contracts/JBController.sol#L2

File: contracts/JBDirectory.sol   #2

2:    pragma solidity 0.8.6;

https://github.com/jbx-protocol/juice-contracts-v2-code4rena/tree/828bf2f3e719873daa08081cfa0d0a6deaa5ace5/contracts/JBDirectory.sol#L2

File: contracts/JBSingleTokenPaymentTerminalStore.sol   #3

2:    pragma solidity 0.8.6;

https://github.com/jbx-protocol/juice-contracts-v2-code4rena/tree/828bf2f3e719873daa08081cfa0d0a6deaa5ace5/contracts/JBSingleTokenPaymentTerminalStore.sol#L2

8. Use scientific notation (e.g. `1e18`) rather than exponentiation (e.g. `10**18`)

There is 1 instance of this issue:

File: contracts/JBSingleTokenPaymentTerminalStore.sol   #1

868:        : PRBMath.mulDiv(_ethOverflow, 10**18, prices.priceFor(JBCurrencies.ETH, _currency, 18));

https://github.com/jbx-protocol/juice-contracts-v2-code4rena/tree/828bf2f3e719873daa08081cfa0d0a6deaa5ace5/contracts/JBSingleTokenPaymentTerminalStore.sol#L868

9. Constant redefined elsewhere

Consider defining in only one contract so that values cannot become out of sync when only one location is updated. A cheap way to store constants in a single location is to create an internal constant in a library. If the variable is a local cache of another contract's value, consider making the cache variable internal or private, which will require external users to query the contract with the source of truth, so that callers don't get out of sync.

There are 11 instances of this issue:

File: contracts/JBController.sol

/// @audit seen in contracts/abstract/JBPayoutRedemptionPaymentTerminal.sol 
111:    IJBProjects public immutable override projects;

/// @audit seen in contracts/abstract/JBPayoutRedemptionPaymentTerminal.sol 
129:    IJBSplitsStore public immutable override splitsStore;

/// @audit seen in contracts/abstract/JBPayoutRedemptionPaymentTerminal.sol 
135:    IJBDirectory public immutable override directory;

https://github.com/jbx-protocol/juice-contracts-v2-code4rena/tree/828bf2f3e719873daa08081cfa0d0a6deaa5ace5/contracts/JBController.sol#L111

File: contracts/JBDirectory.sol

/// @audit seen in contracts/JBController.sol 
65:     IJBProjects public immutable override projects;

/// @audit seen in contracts/JBController.sol 
71:     IJBFundingCycleStore public immutable override fundingCycleStore;

https://github.com/jbx-protocol/juice-contracts-v2-code4rena/tree/828bf2f3e719873daa08081cfa0d0a6deaa5ace5/contracts/JBDirectory.sol#L65

File: contracts/JBSingleTokenPaymentTerminalStore.sol

/// @audit seen in contracts/JBController.sol 
61:     IJBDirectory public immutable override directory;

/// @audit seen in contracts/JBDirectory.sol 
67:     IJBFundingCycleStore public immutable override fundingCycleStore;

/// @audit seen in contracts/abstract/JBPayoutRedemptionPaymentTerminal.sol 
73:     IJBPrices public immutable override prices;

https://github.com/jbx-protocol/juice-contracts-v2-code4rena/tree/828bf2f3e719873daa08081cfa0d0a6deaa5ace5/contracts/JBSingleTokenPaymentTerminalStore.sol#L61

File: contracts/JBSplitsStore.sol

/// @audit seen in contracts/JBDirectory.sol 
81:     IJBProjects public immutable override projects;

/// @audit seen in contracts/JBSingleTokenPaymentTerminalStore.sol 
87:     IJBDirectory public immutable override directory;

https://github.com/jbx-protocol/juice-contracts-v2-code4rena/tree/828bf2f3e719873daa08081cfa0d0a6deaa5ace5/contracts/JBSplitsStore.sol#L81

File: contracts/JBTokenStore.sol

/// @audit seen in contracts/JBSplitsStore.sol 
56:     IJBProjects public immutable override projects;

https://github.com/jbx-protocol/juice-contracts-v2-code4rena/tree/828bf2f3e719873daa08081cfa0d0a6deaa5ace5/contracts/JBTokenStore.sol#L56

10. Inconsistent spacing in comments

Some lines use // x and some use //x. The instances below point out the usages that don't follow the majority, within each file

There is 1 instance of this issue:

File: contracts/JBController.sol   #1

912:      //Transfer between all splits.

https://github.com/jbx-protocol/juice-contracts-v2-code4rena/tree/828bf2f3e719873daa08081cfa0d0a6deaa5ace5/contracts/JBController.sol#L912

11. Lines are too long

Usually lines in source code are limited to 80 characters. Today's screens are much larger so it's reasonable to stretch this in some cases. Since the files will most likely reside in GitHub, and GitHub starts using a scroll bar in all cases when the length is over 164 characters, the lines below should be split when they reach that length

There are 49 instances of this issue:

File: contracts/abstract/JBPayoutRedemptionPaymentTerminal.sol

26:     A project can transfer its funds, along with the power to reconfigure and mint/burn their tokens, from this contract to another allowed terminal of the same token type contract at any time.

30:     IJBPayoutRedemptionPaymentTerminal: General interface for the methods in this contract that interact with the blockchain's state according to the protocol's rules.

322:      @param _amount The amount of terminal tokens being received, as a fixed point number with the same amount of decimals as this terminal. If this terminal's token is ETH, this is ignored and msg.value is used in its place.

326:      @param _preferClaimedTokens A flag indicating whether the request prefers to mint project tokens into the beneficiaries wallet rather than leaving them unclaimed. This is only possible if the project has an attached token contract. Leaving them unclaimed saves gas.

327:      @param _memo A memo to pass along to the emitted event, and passed along the the funding cycle's data source and delegate.  A data source can alter the memo before emitting in the event and forwarding to the delegate.

423:      Anyone can distribute payouts on a project's behalf. The project can preconfigure a wildcard split that is used to send funds to msg.sender. This can be used to incentivize calling this function.

432:      @param _minReturnedTokens The minimum number of terminal tokens that the `_amount` should be valued at in terms of this terminal's currency, as a fixed point number with the same number of decimals as this terminal.

461:      @param _amount The amount of terminal tokens to use from this project's current allowance, as a fixed point number with the same amount of decimals as this terminal.

464:      @param _minReturnedTokens The minimum number of tokens that the `_amount` should be valued at in terms of this terminal's currency, as a fixed point number with 18 decimals.

468:      @return netDistributedAmount The amount of tokens that was distributed to the beneficiary, as a fixed point number with the same amount of decimals as the terminal.

535:      @param _amount The amount of tokens to add, as a fixed point number with the same number of decimals as this terminal. If this is an ETH terminal, this is ignored and msg.value is used instead.

796:      Anyone can distribute payouts on a project's behalf. The project can preconfigure a wildcard split that is used to send funds to msg.sender. This can be used to incentivize calling this function.

804:      @param _minReturnedTokens The minimum number of terminal tokens that the `_amount` should be valued at in terms of this terminal's currency, as a fixed point number with the same number of decimals as this terminal.

913:      @param _amount The amount of terminal tokens to use from this project's current allowance, as a fixed point number with the same amount of decimals as this terminal.

915:      @param _minReturnedTokens The minimum number of tokens that the `_amount` should be valued at in terms of this terminal's currency, as a fixed point number with 18 decimals.

919:      @return netDistributedAmount The amount of tokens that was distributed to the beneficiary, as a fixed point number with the same amount of decimals as the terminal.

1249:     @param _amount The amount of terminal tokens being received, as a fixed point number with the same amount of decimals as this terminal. If this terminal's token is ETH, this is ignored and msg.value is used in its place.

1254:     @param _preferClaimedTokens A flag indicating whether the request prefers to mint project tokens into the beneficiaries wallet rather than leaving them unclaimed. This is only possible if the project has an attached token contract. Leaving them unclaimed saves gas.

1255:     @param _memo A memo to pass along to the emitted event, and passed along the the funding cycle's data source and delegate.  A data source can alter the memo before emitting in the event and forwarding to the delegate.

1349:     @param _amount The amount of tokens to add, as a fixed point number with the same number of decimals as this terminal. If this is an ETH terminal, this is ignored and msg.value is used instead.

https://github.com/jbx-protocol/juice-contracts-v2-code4rena/tree/828bf2f3e719873daa08081cfa0d0a6deaa5ace5/contracts/abstract/JBPayoutRedemptionPaymentTerminal.sol#L26

File: contracts/JBController.sol

23:     IJBController: General interface for the generic controller methods in this contract that interacts with funding cycles and tokens according to the protocol's rules.

28:     JBOperatable: Several functions in this contract can only be accessed by a project owner, or an address that has been preconfifigured to be an operator of the project.

61:       The difference between the processed token tracker of a project and the project's token's total supply is the amount of tokens that still need to have reserves minted against them.

401:      @param _metadata Metadata specifying the controller specific params that a funding cycle can have. These properties will remain fixed for the duration of the funding cycle.

404:      @param _fundAccessConstraints An array containing amounts that a project can use from its treasury for each payment terminal. Amounts are fixed point numbers using the same number of decimals as the accompanying terminal. The `_distributionLimit` and `_overflowAllowance` parameters must fit in a `uint232`.

455:      @param _metadata Metadata specifying the controller specific params that a funding cycle can have. These properties will remain fixed for the duration of the funding cycle.

458:      @param _fundAccessConstraints An array containing amounts that a project can use from its treasury for each payment terminal. Amounts are fixed point numbers using the same number of decimals as the accompanying terminal. The `_distributionLimit` and `_overflowAllowance` parameters must fit in a `uint232`.

505:      Proposes a configuration of a subsequent funding cycle that will take effect once the current one expires if it is approved by the current funding cycle's ballot.

512:      @param _metadata Metadata specifying the controller specific params that a funding cycle can have. These properties will remain fixed for the duration of the funding cycle.

515:      @param _fundAccessConstraints An array containing amounts that a project can use from its treasury for each payment terminal. Amounts are fixed point numbers using the same number of decimals as the accompanying terminal. The `_distributionLimit` and `_overflowAllowance` parameters must fit in a `uint232`.

976:      @param _metadata Metadata specifying the controller specific params that a funding cycle can have. These properties will remain fixed for the duration of the funding cycle.

979:      @param _fundAccessConstraints An array containing amounts that a project can use from its treasury for each payment terminal. Amounts are fixed point numbers using the same number of decimals as the accompanying terminal.

https://github.com/jbx-protocol/juice-contracts-v2-code4rena/tree/828bf2f3e719873daa08081cfa0d0a6deaa5ace5/contracts/JBController.sol#L23

File: contracts/JBDirectory.sol

12:     Keeps a reference of which terminal contracts each project is currently accepting funds through, and which controller contract is managing each project's tokens and funding cycles.

228:      // Setting controller is allowed if called from the current controller, or if the project doesn't have a current controller, or if the project's funding cycle allows setting the controller. Revert otherwise.

https://github.com/jbx-protocol/juice-contracts-v2-code4rena/tree/828bf2f3e719873daa08081cfa0d0a6deaa5ace5/contracts/JBDirectory.sol#L12

File: contracts/JBFundingCycleStore.sol

18:     JBControllerUtility: Includes convenience functionality for checking if the message sender is the current controller of the project whose data is being manipulated.

229:        // If it's not approved or if it hasn't yet started, get a reference to the funding cycle that the latest is based on, which has the latest approved configuration.

https://github.com/jbx-protocol/juice-contracts-v2-code4rena/tree/828bf2f3e719873daa08081cfa0d0a6deaa5ace5/contracts/JBFundingCycleStore.sol#L18

File: contracts/JBOperatorStore.sol

34:       Permissions are stored in a packed `uint256`. Each 256 bits represents the on/off state of a permission. Applications can specify the significance of each index.

https://github.com/jbx-protocol/juice-contracts-v2-code4rena/tree/828bf2f3e719873daa08081cfa0d0a6deaa5ace5/contracts/JBOperatorStore.sol#L34

File: contracts/JBSingleTokenPaymentTerminalStore.sol

19:     IJBSingleTokenPaymentTerminalStore: General interface for the methods in this contract that interact with the blockchain's state according to the protocol's rules.

93:       The amount of funds that a project has distributed from its limit during the current funding cycle for each terminal, in terms of the distribution limit's currency.

111:      The amount of funds that a project has used from its allowance during the current funding cycle configuration for each terminal, in terms of the overflow allowance's currency.

179:      The current amount of overflowed tokens from a terminal that can be reclaimed by the specified number of tokens, using the total token supply and overflow in the ecosystem.

193:      @param _useTotalOverflow A flag indicating whether the overflow used in the calculation should be summed from all of the project's terminals. If false, overflow should be limited to the amount in the specified `_terminal`.

235:      The current amount of overflowed tokens from a terminal that can be reclaimed by the specified number of tokens, using the specified total token supply and overflow amounts.

295:      Mint's the project's tokens according to values provided by a configured data source. If no data source is configured, mints tokens proportional to the amount of the contribution.

398:      Redeems the project's tokens according to values provided by a configured data source. If no data source is configured, redeems tokens along a redemption bonding curve that is a function of the number of tokens being burned.

https://github.com/jbx-protocol/juice-contracts-v2-code4rena/tree/828bf2f3e719873daa08081cfa0d0a6deaa5ace5/contracts/JBSingleTokenPaymentTerminalStore.sol#L19

File: contracts/JBTokenStore.sol

30:     JBControllerUtility: Includes convenience functionality for checking if the message sender is the current controller of the project whose data is being manipulated.

231:      @param _token The new token. Send an empty address to remove the project's current token without adding a new one, if claiming tokens isn't currency required by the project

281:      @param _preferClaimedTokens A flag indicating whether there's a preference for minted tokens to be claimed automatically into the `_holder`s wallet if the project currently has a token contract attached.

318:      @param _preferClaimedTokens A flag indicating whether there's a preference for tokens to burned from the `_holder`s wallet if the project currently has a token contract attached.

https://github.com/jbx-protocol/juice-contracts-v2-code4rena/tree/828bf2f3e719873daa08081cfa0d0a6deaa5ace5/contracts/JBTokenStore.sol#L30

12. Typos

There are 17 instances of this issue:

File: contracts/abstract/JBPayoutRedemptionPaymentTerminal.sol

/// @audit adherance
247:      @param _interfaceId The ID of the interface to check for adherance to.

/// @audit incure
426:      All funds distributed outside of this contract or any feeless terminals incure the protocol fee.

/// @audit incure
799:      All funds distributed outside of this contract or any feeless terminals incure the protocol fee.

/// @audit convinience
837:        // If the fee is zero or if the fee is being used by an address that doesn't incur fees, set the discount to 100% for convinience.

/// @audit convinience
948:        // If the fee is zero or if the fee is being used by an address that doesn't incur fees, set the discount to 100% for convinience.

/// @audit prefered
1077:             // Add to balance if prefered.

/// @audit prefered
1116:             // Add to balance if prefered.

/// @audit guage
1470:       // If the guage reverts, set the discount to 0.

https://github.com/jbx-protocol/juice-contracts-v2-code4rena/tree/828bf2f3e719873daa08081cfa0d0a6deaa5ace5/contracts/abstract/JBPayoutRedemptionPaymentTerminal.sol#L247

File: contracts/interfaces/IJBSplitAllocator.sol

/// @audit transfered
27:       Critical business logic should be protected by an appropriate access control. The token and/or eth are optimistically transfered

https://github.com/jbx-protocol/juice-contracts-v2-code4rena/tree/828bf2f3e719873daa08081cfa0d0a6deaa5ace5/contracts/interfaces/IJBSplitAllocator.sol#L27

File: contracts/JBController.sol

/// @audit preconfifigured
28:     JBOperatable: Several functions in this contract can only be accessed by a project owner, or an address that has been preconfifigured to be an operator of the project.

/// @audit adherance
341:      @param _interfaceId The ID of the interface to check for adherance to.

/// @audit dont
898:      @return leftoverAmount If the splits percents dont add up to 100%, the leftover amount is returned.

https://github.com/jbx-protocol/juice-contracts-v2-code4rena/tree/828bf2f3e719873daa08081cfa0d0a6deaa5ace5/contracts/JBController.sol#L28

File: contracts/JBFundingCycleStore.sol

/// @audit instrinsic
47:       _projectId The ID of the project to get instrinsic properties of.

https://github.com/jbx-protocol/juice-contracts-v2-code4rena/tree/828bf2f3e719873daa08081cfa0d0a6deaa5ace5/contracts/JBFundingCycleStore.sol#L47

File: contracts/JBProjects.sol

/// @audit adherance
84:       @param _interfaceId The ID of the interface to check for adherance to.

https://github.com/jbx-protocol/juice-contracts-v2-code4rena/tree/828bf2f3e719873daa08081cfa0d0a6deaa5ace5/contracts/JBProjects.sol#L84

File: contracts/JBSingleTokenPaymentTerminalStore.sol

/// @audit mumber
384:      // The weight is always a fixed point mumber with 18 decimals. To ensure this, the ratio should use the same number of decimals as the `_amount`.

/// @audit areference
452:          // Get areference to the terminal's currency.

https://github.com/jbx-protocol/juice-contracts-v2-code4rena/tree/828bf2f3e719873daa08081cfa0d0a6deaa5ace5/contracts/JBSingleTokenPaymentTerminalStore.sol#L384

File: contracts/JBSplitsStore.sol

/// @audit extention
218:            // Allow lock extention.

https://github.com/jbx-protocol/juice-contracts-v2-code4rena/tree/828bf2f3e719873daa08081cfa0d0a6deaa5ace5/contracts/JBSplitsStore.sol#L218

13. File is missing NatSpec

There are 29 instances of this issue:

File: contracts/interfaces/IJBAllowanceTerminal.sol

https://github.com/jbx-protocol/juice-contracts-v2-code4rena/tree/828bf2f3e719873daa08081cfa0d0a6deaa5ace5/contracts/interfaces/IJBAllowanceTerminal.sol

File: contracts/interfaces/IJBController.sol

https://github.com/jbx-protocol/juice-contracts-v2-code4rena/tree/828bf2f3e719873daa08081cfa0d0a6deaa5ace5/contracts/interfaces/IJBController.sol

File: contracts/interfaces/IJBControllerUtility.sol

https://github.com/jbx-protocol/juice-contracts-v2-code4rena/tree/828bf2f3e719873daa08081cfa0d0a6deaa5ace5/contracts/interfaces/IJBControllerUtility.sol

File: contracts/interfaces/IJBDirectory.sol

https://github.com/jbx-protocol/juice-contracts-v2-code4rena/tree/828bf2f3e719873daa08081cfa0d0a6deaa5ace5/contracts/interfaces/IJBDirectory.sol

File: contracts/interfaces/IJBETHERC20ProjectPayerDeployer.sol

https://github.com/jbx-protocol/juice-contracts-v2-code4rena/tree/828bf2f3e719873daa08081cfa0d0a6deaa5ace5/contracts/interfaces/IJBETHERC20ProjectPayerDeployer.sol

File: contracts/interfaces/IJBETHERC20SplitsPayerDeployer.sol

https://github.com/jbx-protocol/juice-contracts-v2-code4rena/tree/828bf2f3e719873daa08081cfa0d0a6deaa5ace5/contracts/interfaces/IJBETHERC20SplitsPayerDeployer.sol

File: contracts/interfaces/IJBFeeGauge.sol

https://github.com/jbx-protocol/juice-contracts-v2-code4rena/tree/828bf2f3e719873daa08081cfa0d0a6deaa5ace5/contracts/interfaces/IJBFeeGauge.sol

File: contracts/interfaces/IJBFundingCycleBallot.sol

https://github.com/jbx-protocol/juice-contracts-v2-code4rena/tree/828bf2f3e719873daa08081cfa0d0a6deaa5ace5/contracts/interfaces/IJBFundingCycleBallot.sol

File: contracts/interfaces/IJBFundingCycleStore.sol

https://github.com/jbx-protocol/juice-contracts-v2-code4rena/tree/828bf2f3e719873daa08081cfa0d0a6deaa5ace5/contracts/interfaces/IJBFundingCycleStore.sol

File: contracts/interfaces/IJBMigratable.sol

https://github.com/jbx-protocol/juice-contracts-v2-code4rena/tree/828bf2f3e719873daa08081cfa0d0a6deaa5ace5/contracts/interfaces/IJBMigratable.sol

File: contracts/interfaces/IJBOperatable.sol

https://github.com/jbx-protocol/juice-contracts-v2-code4rena/tree/828bf2f3e719873daa08081cfa0d0a6deaa5ace5/contracts/interfaces/IJBOperatable.sol

File: contracts/interfaces/IJBOperatorStore.sol

https://github.com/jbx-protocol/juice-contracts-v2-code4rena/tree/828bf2f3e719873daa08081cfa0d0a6deaa5ace5/contracts/interfaces/IJBOperatorStore.sol

File: contracts/interfaces/IJBPaymentTerminal.sol

https://github.com/jbx-protocol/juice-contracts-v2-code4rena/tree/828bf2f3e719873daa08081cfa0d0a6deaa5ace5/contracts/interfaces/IJBPaymentTerminal.sol

File: contracts/interfaces/IJBPayoutRedemptionPaymentTerminal.sol

https://github.com/jbx-protocol/juice-contracts-v2-code4rena/tree/828bf2f3e719873daa08081cfa0d0a6deaa5ace5/contracts/interfaces/IJBPayoutRedemptionPaymentTerminal.sol

File: contracts/interfaces/IJBPayoutTerminal.sol

https://github.com/jbx-protocol/juice-contracts-v2-code4rena/tree/828bf2f3e719873daa08081cfa0d0a6deaa5ace5/contracts/interfaces/IJBPayoutTerminal.sol

File: contracts/interfaces/IJBPriceFeed.sol

https://github.com/jbx-protocol/juice-contracts-v2-code4rena/tree/828bf2f3e719873daa08081cfa0d0a6deaa5ace5/contracts/interfaces/IJBPriceFeed.sol

File: contracts/interfaces/IJBPrices.sol

https://github.com/jbx-protocol/juice-contracts-v2-code4rena/tree/828bf2f3e719873daa08081cfa0d0a6deaa5ace5/contracts/interfaces/IJBPrices.sol

File: contracts/interfaces/IJBProjectPayer.sol

https://github.com/jbx-protocol/juice-contracts-v2-code4rena/tree/828bf2f3e719873daa08081cfa0d0a6deaa5ace5/contracts/interfaces/IJBProjectPayer.sol

File: contracts/interfaces/IJBProjects.sol

https://github.com/jbx-protocol/juice-contracts-v2-code4rena/tree/828bf2f3e719873daa08081cfa0d0a6deaa5ace5/contracts/interfaces/IJBProjects.sol

File: contracts/interfaces/IJBReconfigurationBufferBallot.sol

https://github.com/jbx-protocol/juice-contracts-v2-code4rena/tree/828bf2f3e719873daa08081cfa0d0a6deaa5ace5/contracts/interfaces/IJBReconfigurationBufferBallot.sol

File: contracts/interfaces/IJBRedemptionTerminal.sol

https://github.com/jbx-protocol/juice-contracts-v2-code4rena/tree/828bf2f3e719873daa08081cfa0d0a6deaa5ace5/contracts/interfaces/IJBRedemptionTerminal.sol

File: contracts/interfaces/IJBSingleTokenPaymentTerminal.sol

https://github.com/jbx-protocol/juice-contracts-v2-code4rena/tree/828bf2f3e719873daa08081cfa0d0a6deaa5ace5/contracts/interfaces/IJBSingleTokenPaymentTerminal.sol

File: contracts/interfaces/IJBSingleTokenPaymentTerminalStore.sol

https://github.com/jbx-protocol/juice-contracts-v2-code4rena/tree/828bf2f3e719873daa08081cfa0d0a6deaa5ace5/contracts/interfaces/IJBSingleTokenPaymentTerminalStore.sol

File: contracts/interfaces/IJBSplitsPayer.sol

https://github.com/jbx-protocol/juice-contracts-v2-code4rena/tree/828bf2f3e719873daa08081cfa0d0a6deaa5ace5/contracts/interfaces/IJBSplitsPayer.sol

File: contracts/interfaces/IJBSplitsStore.sol

https://github.com/jbx-protocol/juice-contracts-v2-code4rena/tree/828bf2f3e719873daa08081cfa0d0a6deaa5ace5/contracts/interfaces/IJBSplitsStore.sol

File: contracts/interfaces/IJBTerminalUtility.sol

https://github.com/jbx-protocol/juice-contracts-v2-code4rena/tree/828bf2f3e719873daa08081cfa0d0a6deaa5ace5/contracts/interfaces/IJBTerminalUtility.sol

File: contracts/interfaces/IJBToken.sol

https://github.com/jbx-protocol/juice-contracts-v2-code4rena/tree/828bf2f3e719873daa08081cfa0d0a6deaa5ace5/contracts/interfaces/IJBToken.sol

File: contracts/interfaces/IJBTokenStore.sol

https://github.com/jbx-protocol/juice-contracts-v2-code4rena/tree/828bf2f3e719873daa08081cfa0d0a6deaa5ace5/contracts/interfaces/IJBTokenStore.sol

File: contracts/interfaces/IJBTokenUriResolver.sol

https://github.com/jbx-protocol/juice-contracts-v2-code4rena/tree/828bf2f3e719873daa08081cfa0d0a6deaa5ace5/contracts/interfaces/IJBTokenUriResolver.sol

14. NatSpec is incomplete

There are 5 instances of this issue:

File: contracts/abstract/JBPayoutRedemptionPaymentTerminal.sol

/// @audit Missing: '@return'
247       @param _interfaceId The ID of the interface to check for adherance to.
248     */
249     function supportsInterface(bytes4 _interfaceId)
250       public
251       view
252       virtual
253       override(JBSingleTokenPaymentTerminal, IERC165)
254:      returns (bool)

https://github.com/jbx-protocol/juice-contracts-v2-code4rena/tree/828bf2f3e719873daa08081cfa0d0a6deaa5ace5/contracts/abstract/JBPayoutRedemptionPaymentTerminal.sol#L247-L254

File: contracts/JBController.sol

/// @audit Missing: '@param _configuration'
249     /** 
250       @notice
251       A project's funding cycle for the specified configuration along with its metadata.
252   
253       @param _projectId The ID of the project to which the funding cycle belongs.
254     
255       @return fundingCycle The funding cycle.
256       @return metadata The funding cycle's metadata.
257     */
258     function getFundingCycleOf(uint256 _projectId, uint256 _configuration)
259       external
260       view
261       override
262:      returns (JBFundingCycle memory fundingCycle, JBFundingCycleMetadata memory metadata)

/// @audit Missing: '@return'
341       @param _interfaceId The ID of the interface to check for adherance to.
342     */
343     function supportsInterface(bytes4 _interfaceId)
344       public
345       view
346       virtual
347       override(ERC165, IERC165)
348:      returns (bool)

/// @audit Missing: '@return'
560       @param _symbol The ERC20's symbol.
561     */
562     function issueTokenFor(
563       uint256 _projectId,
564       string calldata _name,
565       string calldata _symbol
566     )
567       external
568       virtual
569       override
570       requirePermission(projects.ownerOf(_projectId), _projectId, JBOperations.ISSUE)
571:      returns (IJBToken token)

https://github.com/jbx-protocol/juice-contracts-v2-code4rena/tree/828bf2f3e719873daa08081cfa0d0a6deaa5ace5/contracts/JBController.sol#L249-L262

File: contracts/JBProjects.sol

/// @audit Missing: '@return'
84        @param _interfaceId The ID of the interface to check for adherance to.
85      */
86      function supportsInterface(bytes4 _interfaceId)
87        public
88        view
89        virtual
90        override(IERC165, ERC721)
91:       returns (bool)

https://github.com/jbx-protocol/juice-contracts-v2-code4rena/tree/828bf2f3e719873daa08081cfa0d0a6deaa5ace5/contracts/JBProjects.sol#L84-L91

15. Event is missing `indexed` fields

Index event fields make the field more quickly accessible to off-chain tools that parse events. However, note that each index field costs extra gas during emission, so it's not necessarily best to index the maximum allowed per event (threefields). Each event should use three indexed fields if there are three or more fields, and gas usage is not particularly of concern for the events in question

There are 34 instances of this issue:

File: contracts/interfaces/IJBController.sol

19:     event LaunchProject(uint256 configuration, uint256 projectId, string memo, address caller);

21:     event LaunchFundingCycles(uint256 configuration, uint256 projectId, string memo, address caller);

23      event ReconfigureFundingCycles(
24        uint256 configuration,
25        uint256 projectId,
26        string memo,
27        address caller
28:     );

58      event MintTokens(
59        address indexed beneficiary,
60        uint256 indexed projectId,
61        uint256 tokenCount,
62        uint256 beneficiaryTokenCount,
63        string memo,
64        uint256 reservedRate,
65        address caller
66:     );

68      event BurnTokens(
69        address indexed holder,
70        uint256 indexed projectId,
71        uint256 tokenCount,
72        string memo,
73        address caller
74:     );

76:     event Migrate(uint256 indexed projectId, IJBMigratable to, address caller);

78:     event PrepMigration(uint256 indexed projectId, address from, address caller);

https://github.com/jbx-protocol/juice-contracts-v2-code4rena/tree/828bf2f3e719873daa08081cfa0d0a6deaa5ace5/contracts/interfaces/IJBController.sol#L19

File: contracts/interfaces/IJBDirectory.sol

9:      event SetController(uint256 indexed projectId, address indexed controller, address caller);

11:     event AddTerminal(uint256 indexed projectId, IJBPaymentTerminal indexed terminal, address caller);

13:     event SetTerminals(uint256 indexed projectId, IJBPaymentTerminal[] terminals, address caller);

22:     event SetIsAllowedToSetFirstController(address indexed addr, bool indexed flag, address caller);

https://github.com/jbx-protocol/juice-contracts-v2-code4rena/tree/828bf2f3e719873daa08081cfa0d0a6deaa5ace5/contracts/interfaces/IJBDirectory.sol#L9

File: contracts/interfaces/IJBETHERC20ProjectPayerDeployer.sol

8       event DeployProjectPayer(
9         IJBProjectPayer indexed projectPayer,
10        uint256 defaultProjectId,
11        address defaultBeneficiary,
12        bool defaultPreferClaimedTokens,
13        string defaultMemo,
14        bytes defaultMetadata,
15        bool preferAddToBalance,
16        IJBDirectory directory,
17        address owner,
18        address caller
19:     );

https://github.com/jbx-protocol/juice-contracts-v2-code4rena/tree/828bf2f3e719873daa08081cfa0d0a6deaa5ace5/contracts/interfaces/IJBETHERC20ProjectPayerDeployer.sol#L8-L19

File: contracts/interfaces/IJBETHERC20SplitsPayerDeployer.sol

8       event DeploySplitsPayer(
9         IJBSplitsPayer indexed splitsPayer,
10        uint256 defaultSplitsProjectId,
11        uint256 defaultSplitsDomain,
12        uint256 defaultSplitsGroup,
13        IJBSplitsStore splitsStore,
14        uint256 defaultProjectId,
15        address defaultBeneficiary,
16        bool defaultPreferClaimedTokens,
17        string defaultMemo,
18        bytes defaultMetadata,
19        bool preferAddToBalance,
20        address owner,
21        address caller
22:     );

https://github.com/jbx-protocol/juice-contracts-v2-code4rena/tree/828bf2f3e719873daa08081cfa0d0a6deaa5ace5/contracts/interfaces/IJBETHERC20SplitsPayerDeployer.sol#L8-L22

File: contracts/interfaces/IJBFundingCycleStore.sol

9       event Configure(
10        uint256 indexed configuration,
11        uint256 indexed projectId,
12        JBFundingCycleData data,
13        uint256 metadata,
14        uint256 mustStartAtOrAfter,
15        address caller
16:     );

https://github.com/jbx-protocol/juice-contracts-v2-code4rena/tree/828bf2f3e719873daa08081cfa0d0a6deaa5ace5/contracts/interfaces/IJBFundingCycleStore.sol#L9-L16

File: contracts/interfaces/IJBPayoutRedemptionPaymentTerminal.sol

26      event AddToBalance(
27        uint256 indexed projectId,
28        uint256 amount,
29        uint256 refundedFees,
30        string memo,
31        bytes metadata,
32        address caller
33:     );

35      event Migrate(
36        uint256 indexed projectId,
37        IJBPaymentTerminal indexed to,
38        uint256 amount,
39        address caller
40:     );

105:    event DelegateDidPay(IJBPayDelegate indexed delegate, JBDidPayData data, address caller);

120     event DelegateDidRedeem(
121       IJBRedemptionDelegate indexed delegate,
122       JBDidRedeemData data,
123       address caller
124:    );

135:    event SetFee(uint256 fee, address caller);

137:    event SetFeeGauge(IJBFeeGauge indexed feeGauge, address caller);

139:    event SetFeelessAddress(address indexed addrs, bool indexed flag, address caller);

https://github.com/jbx-protocol/juice-contracts-v2-code4rena/tree/828bf2f3e719873daa08081cfa0d0a6deaa5ace5/contracts/interfaces/IJBPayoutRedemptionPaymentTerminal.sol#L26-L33

File: contracts/interfaces/IJBPrices.sol

7:      event AddFeed(uint256 indexed currency, uint256 indexed base, IJBPriceFeed feed);

https://github.com/jbx-protocol/juice-contracts-v2-code4rena/tree/828bf2f3e719873daa08081cfa0d0a6deaa5ace5/contracts/interfaces/IJBPrices.sol#L7

File: contracts/interfaces/IJBProjectPayer.sol

8       event SetDefaultValues(
9         uint256 indexed projectId,
10        address indexed beneficiary,
11        bool preferClaimedTokens,
12        string memo,
13        bytes metadata,
14        bool preferAddToBalance,
15        address caller
16:     );

https://github.com/jbx-protocol/juice-contracts-v2-code4rena/tree/828bf2f3e719873daa08081cfa0d0a6deaa5ace5/contracts/interfaces/IJBProjectPayer.sol#L8-L16

File: contracts/interfaces/IJBProjects.sol

9       event Create(
10        uint256 indexed projectId,
11        address indexed owner,
12        JBProjectMetadata metadata,
13        address caller
14:     );

16:     event SetMetadata(uint256 indexed projectId, JBProjectMetadata metadata, address caller);

18:     event SetTokenUriResolver(IJBTokenUriResolver indexed resolver, address caller);

https://github.com/jbx-protocol/juice-contracts-v2-code4rena/tree/828bf2f3e719873daa08081cfa0d0a6deaa5ace5/contracts/interfaces/IJBProjects.sol#L9-L14

File: contracts/interfaces/IJBSplitsPayer.sol

15      event Pay(
16        uint256 indexed projectId,
17        address beneficiary,
18        address token,
19        uint256 amount,
20        uint256 decimals,
21        uint256 leftoverAmount,
22        uint256 minReturnedTokens,
23        bool preferClaimedTokens,
24        string memo,
25        bytes metadata,
26        address caller
27:     );

29      event AddToBalance(
30        uint256 indexed projectId,
31        address beneficiary,
32        address token,
33        uint256 amount,
34        uint256 decimals,
35        uint256 leftoverAmount,
36        string memo,
37        bytes metadata,
38        address caller
39:     );

48      event DistributeToSplit(
49        JBSplit split,
50        uint256 amount,
51        address defaultBeneficiary,
52        address caller
53:     );

https://github.com/jbx-protocol/juice-contracts-v2-code4rena/tree/828bf2f3e719873daa08081cfa0d0a6deaa5ace5/contracts/interfaces/IJBSplitsPayer.sol#L15-L27

File: contracts/interfaces/IJBTokenStore.sol

8       event Issue(
9         uint256 indexed projectId,
10        IJBToken indexed token,
11        string name,
12        string symbol,
13        address caller
14:     );

16      event Mint(
17        address indexed holder,
18        uint256 indexed projectId,
19        uint256 amount,
20        bool tokensWereClaimed,
21        bool preferClaimedTokens,
22        address caller
23:     );

25      event Burn(
26        address indexed holder,
27        uint256 indexed projectId,
28        uint256 amount,
29        uint256 initialUnclaimedBalance,
30        uint256 initialClaimedBalance,
31        bool preferClaimedTokens,
32        address caller
33:     );

35      event Claim(
36        address indexed holder,
37        uint256 indexed projectId,
38        uint256 initialUnclaimedBalance,
39        uint256 amount,
40        address caller
41:     );

43:     event ShouldRequireClaim(uint256 indexed projectId, bool indexed flag, address caller);

https://github.com/jbx-protocol/juice-contracts-v2-code4rena/tree/828bf2f3e719873daa08081cfa0d0a6deaa5ace5/contracts/interfaces/IJBTokenStore.sol#L8-L14

16. Not using the named return variables anywhere in the function is confusing

Consider changing the variable to be an unnamed one

There are 6 instances of this issue:

File: contracts/abstract/JBPayoutRedemptionPaymentTerminal.sol

/// @audit reclaimAmount
385     function redeemTokensOf(
386       address _holder,
387       uint256 _projectId,
388       uint256 _tokenCount,
389       address _token,
390       uint256 _minReturnedTokens,
391       address payable _beneficiary,
392       string memory _memo,
393       bytes memory _metadata
394     )
395       external
396       virtual
397       override
398       requirePermission(_holder, _projectId, JBOperations.REDEEM)
399:      returns (uint256 reclaimAmount)

/// @audit netLeftoverDistributionAmount
437     function distributePayoutsOf(
438       uint256 _projectId,
439       uint256 _amount,
440       uint256 _currency,
441       address _token,
442       uint256 _minReturnedTokens,
443       string calldata _memo
444:    ) external virtual override returns (uint256 netLeftoverDistributionAmount) {

/// @audit netDistributedAmount
470     function useAllowanceOf(
471       uint256 _projectId,
472       uint256 _amount,
473       uint256 _currency,
474       address _token,
475       uint256 _minReturnedTokens,
476       address payable _beneficiary,
477       string memory _memo
478     )
479       external
480       virtual
481       override
482       requirePermission(projects.ownerOf(_projectId), _projectId, JBOperations.USE_ALLOWANCE)
483:      returns (uint256 netDistributedAmount)

https://github.com/jbx-protocol/juice-contracts-v2-code4rena/tree/828bf2f3e719873daa08081cfa0d0a6deaa5ace5/contracts/abstract/JBPayoutRedemptionPaymentTerminal.sol#L385-L399

File: contracts/JBController.sol

/// @audit token
562     function issueTokenFor(
563       uint256 _projectId,
564       string calldata _name,
565       string calldata _symbol
566     )
567       external
568       virtual
569       override
570       requirePermission(projects.ownerOf(_projectId), _projectId, JBOperations.ISSUE)
571:      returns (IJBToken token)

https://github.com/jbx-protocol/juice-contracts-v2-code4rena/tree/828bf2f3e719873daa08081cfa0d0a6deaa5ace5/contracts/JBController.sol#L562-L571

File: contracts/JBFundingCycleStore.sol

/// @audit fundingCycle
86      function get(uint256 _projectId, uint256 _configuration)
87        external
88        view
89        override
90:       returns (JBFundingCycle memory fundingCycle)

/// @audit fundingCycle
194     function currentOf(uint256 _projectId)
195       external
196       view
197       override
198:      returns (JBFundingCycle memory fundingCycle)

https://github.com/jbx-protocol/juice-contracts-v2-code4rena/tree/828bf2f3e719873daa08081cfa0d0a6deaa5ace5/contracts/JBFundingCycleStore.sol#L86-L90

code-423n4 / 2022-07-juicebox-findings

QA Report #299

Summary

Low Risk Issues

Non-critical Issues

Low Risk Issues

1. Weight of one being used as zero not documented

2. Calls may run out of gas until arrays are reduced in size

3. Dust amounts not compensated, even if not using price oracle

4. Splits can't be locked once the timestamp passes `type(uint48).max`

5. Unsafe use of `transfer()`/`transferFrom()` with `IERC20`

Non-critical Issues

1. Confusing variable names

2. Return values of `approve()` not checked

3. Adding a `return` statement when the function defines a named return variable, is redundant

4. Non-assembly method available

5. `constant`s should be defined rather than using magic numbers

6. Use a more recent version of solidity

7. Use a more recent version of solidity

8. Use scientific notation (e.g. `1e18`) rather than exponentiation (e.g. `10**18`)

9. Constant redefined elsewhere

10. Inconsistent spacing in comments

11. Lines are too long

12. Typos

13. File is missing NatSpec

14. NatSpec is incomplete

15. Event is missing `indexed` fields

16. Not using the named return variables anywhere in the function is confusing

code-423n4 / 2022-07-juicebox-findings

QA Report #299

Summary

Low Risk Issues

Non-critical Issues

Low Risk Issues

1. Weight of one being used as zero not documented

2. Calls may run out of gas until arrays are reduced in size

3. Dust amounts not compensated, even if not using price oracle

4. Splits can't be locked once the timestamp passes type(uint48).max

5. Unsafe use of transfer()/transferFrom() with IERC20

Non-critical Issues

1. Confusing variable names

2. Return values of approve() not checked

3. Adding a return statement when the function defines a named return variable, is redundant

4. Non-assembly method available

5. constants should be defined rather than using magic numbers

6. Use a more recent version of solidity

7. Use a more recent version of solidity

8. Use scientific notation (e.g. 1e18) rather than exponentiation (e.g. 10**18)

9. Constant redefined elsewhere

10. Inconsistent spacing in comments

11. Lines are too long

12. Typos

13. File is missing NatSpec

14. NatSpec is incomplete

15. Event is missing indexed fields

16. Not using the named return variables anywhere in the function is confusing

4. Splits can't be locked once the timestamp passes `type(uint48).max`

5. Unsafe use of `transfer()`/`transferFrom()` with `IERC20`

2. Return values of `approve()` not checked

3. Adding a `return` statement when the function defines a named return variable, is redundant

5. `constant`s should be defined rather than using magic numbers

8. Use scientific notation (e.g. `1e18`) rather than exponentiation (e.g. `10**18`)

15. Event is missing `indexed` fields