Open code423n4 opened 2 years ago
because 40+ custom errors are too many to add to a contract. their is / will be further clear documentation on what those error codes are.
i fail to see how it could be malicious
disagree. first arguments are not variables. single letter tokens are reserved strictly for arguments in swivel (in all our codebases). they prevent the use of dangling underscores and help with the exhaustion-of-good-vars problem.
maybe. will discuss this.
possibly implementing the cancel optimization. if yes the change is: https://github.com/Swivel-Finance/gost/pull/438
Missing invalid market check
https://github.com/code-423n4/2022-07-swivel/blob/main/Marketplace/MarketPlace.sol
Any functions that declare
Market memory market = markets[p][u][m];
Should check whether market has a valid zctoken or not but now it don't check it which allow malicious market input.
We may not need signature to cancel order
Just check whether
msg.sender == o[i].maker
is enough to allow cancellation https://github.com/code-423n4/2022-07-swivel/blob/daf72892d8a8d6eaa43b9e7d1924ccb0e612ee3c/Swivel/Swivel.sol#L407-L423Change to this
Exception is hard to read
What is 30? Why not consider using separated custom errors?
Variables name are hard to read
Should be