search

code-423n4 / 2022-10-juicebox-findings

2 stars 0 forks source link

QA Report #112

Open code423n4 opened 2 years ago

code423n4 commented 2 years ago

QA Report for Juicebox contest

Overview

During the audit, 1 low and 9 non-critical issues were found.

№ Title Risk Rating Instance Count
L-1 Possible DoS Low 4
NC-1 Order of Functions Non-Critical 7
NC-2 Public functions can be external Non-Critical 7
NC-3 Comment lines are too long Non-Critical 10
NC-4 No error message in require Non-Critical 2
NC-5 Unused named return variables Non-Critical 4
NC-6 Constants may be used Non-Critical 8
NC-7 Missing NatSpec Non-Critical 7
NC-8 British English and American English Non-Critical 1
NC-9 Typos and grammar errors Non-Critical 38

Low Risk Findings (1)

L-1. Possible DoS

Description

If the user adds too many tiers, four functions can run out of gas.

Instances
Recommendation

Add the check in this function to prevent the user from adding too many tiers.

Non-Critical Risk Findings (9)

NC-1. Order of Functions

Description

According to Style Guide, ordering helps readers identify which functions they can call and to find the constructor and fallback definitions easier.
Functions should be grouped according to their visibility and ordered: 1) constructor 2) receive function (if exists) 3) fallback function (if exists) 4) external 5) public 6) internal 7) private

Within a grouping, place the view and pure functions last.

Instances

Constructor after functions:

External functions after public:

External functions between public:

Public functions between external:

Recommendation

Reorder functions where possible.

#

NC-2. Public functions can be external

Description

If functions are not called by the contract where they are defined, they can be declared external.

Instances
Recommendation

Make public functions external, where possible.

#

NC-3. Comment lines are too long

Instances
Recommendation

For readability, split comments across multiple lines.

#

NC-4. No error message in require

Instances

#

NC-5. Unused named return variables

Description

Both named return variable(s) and return statement are used.

Instances
Recommendation

To improve clarity use only named return variables.
For example, change:

function functionName() returns (uint id) {
    return x;

to

function functionName() returns (uint id) {
    id = x;

#

NC-6. Constants may be used

Description

Constants may be used instead of literal values.

Instances

For 58:

For 256:

#

NC-7. Missing NatSpec

Description

NatSpec is missing for 7 functions in 2 contracts.

Instances
Recommendation

Add NatSpec for all functions.

#

NC-8. British English and American English

Instances
Recommendation

Choose one.

#

NC-9. Typos and grammar errors

Instances
c4-judge commented 2 years ago

Picodes marked the issue as grade-b