Open code423n4 opened 2 years ago
Use safeMint
Agree will fix - for context see our response here.
Use fixed pragma
Disagree. We intentionally use a floating pragma in order to make integrating with contracts easier. Other contract developers are looking to interact with our contracts and they may be on a different version than we use. The pragma selected for our contracts is the minimum required in order to correctly compile and function. This way integration is easier if they lag a few versions behind, or if they use the latest but we don't bump our packages frequently enough, and when we do upgrade versions unless there was a breaking solidity change -- it should just swap in by incrementing our npm package version.
Unresolved TODO comments
Agree, will fix.
Remove commented out code
Disagree - this comment is detailing how that awkwardly placed gap was previously used so future me can understand why it's important for upgrade compatibility that we don't leverage that space again (since those slots are dirty with data).
1. _safeMint() should be used rather than _mint() wherever possible
_mint()
is discouraged in favour of_safeMint()
which ensures that the recipient is either an EOA or implementsIERC721Receiver
. Both open OpenZeppelin and solmate have versions of this function so that NFTs aren’t lost if they’re minted to contracts that cannot transfer them back out.Instances
contracts/NFTCollection.sol:271 contracts/NFTCollection.sol:182
Recommendations:
Use _safeMint() instead of _mint().
2. USE OF FLOATING PRAGMA
Recommend using fixed solidity version
Instances
All contracts in scope contains floating pragma: https://github.com/code-423n4/2022-08-foundation#sizes
3. Open TODOs
Code architecture, incentives, and error handling/reporting questions/issues should be resolved before deployment
Instances:
contracts/mixins/shared/MarketFees.sol:193
Recommendations:
Remove the commented code
4. Remove commented function or code of no use.
contracts/mixins/shared/MarketFees.sol
References:
https://code4rena.com/reports/2022-05-sturdy#n-12-remove-commented-out-code