Open code423n4 opened 2 years ago
Avoid naming collision (1 instance)
Invalid. That is not a variable name, but part of the type being returned.
Unsafe ERC20 Operation(s) (3 instances)
Invalid. Both contracts listed here are out of scope (one is a mock contract!)
Unspecific Compiler Version Pragma (62 instances)
Disagree. We intentionally use a floating pragma in order to make integrating with contracts easier. Other contract developers are looking to interact with our contracts and they may be on a different version than we use. The pragma selected for our contracts is the minimum required in order to correctly compile and function. This way integration is easier if they lag a few versions behind, or if they use the latest but we don't bump our packages frequently enough, and when we do upgrade versions unless there was a breaking solidity change -- it should just swap in by incrementing our npm package version.
Do not use Deprecated Library Functions (3 instances)
Agree, will switch to _grantRole
here. It was also inconsistent with our other role contracts which had already made this change.
File is missing NatSpec (7 instances)
Yes fair feedback, our interface documentation needs improvement.
Foundation Drop Contest QA Report
Summary
The following QA issues were found during the code audit:
Total 76 instances of 5 issues.
Avoid naming collision (1 instance)
Don't use Solidity keyword such as
storage
as variable name:Unsafe ERC20 Operation(s) (3 instances)
ERC20 operations can be unsafe due to different implementations and vulnerabilities in the standard. It is therefore recommended to always either use OpenZeppelin's SafeERC20 library or at least to wrap each operation in a require statement.
Unspecific Compiler Version Pragma (62 instances)
Avoid floating pragmas for non-library contracts. While floating pragmas make sense for libraries to allow them to be included with multiple different versions of applications, it may be a security risk for application implementations. A known vulnerable compiler version may accidentally be selected or security tools might fall-back to an older compiler version ending up checking a different EVM compilation that is ultimately deployed on the blockchain. It is recommended to pin to a concrete compiler version.
Do not use Deprecated Library Functions (3 instances)
The usage of deprecated library functions should be discouraged. This issue is mostly related to OpenZeppelin libraries.
File is missing NatSpec (7 instances)
Providing NatSpec is a good practice for further development / debugging etc.