Every function should have a short textual description.
In addition to the textual description, there should be a formal documentation for every parameter (@param).
There are A LOT of instances of this problem listed below. Quite a few borderline ok instances (missing formal parameters but described as text or obvious parameters) were not included in the report.
Undocumented parameter: data
/**
* @dev Admin function for new implementation to accept its role as implementation.
*/
function acceptUpgradeAndCall(bytes calldata data) external ifAdminOrPendingImpl {
/**
* @notice Receives withdrawn tokens from L2
* The equivalent tokens are released from escrow and sent to the destination.
* @dev can only accept transactions coming from the L2 GRT Gateway.
* The last parameter is unused but kept for compatibility with Arbitrum gateways,
* and the encoded exitNum is assumed to be 0.
* @param _l1Token L1 Address of the GRT contract (needed for compatibility with Arbitrum Gateway Router)
* @param _from Address of the sender
* @param _to Recepient address on L1
* @param _amount Amount of tokens transferred
*/
function finalizeInboundTransfer(
address _l1Token,
address _from,
address _to,
uint256 _amount,
bytes calldata // _data, contains exitNum, unused by this contract
) external payable override notPaused onlyL2Counterpart {
Solidity Version
Consider using the most recent version of solidity. 0.8.17 is already released and most contracts in the project specify ^0.7.6.
Consider using the same version of solidity in all files. A fixed version of solidity should be specified in all non-library files.
Most contracts in the project specify ^0.7.6.
pragma solidity ^0.7.6; https://github.com/code-423n4/2022-10-thegraph/tree/main/contracts/governance/Managed.sol#L3
But not all:
pragma solidity >=0.6.12 <0.8.0; https://github.com/code-423n4/2022-10-thegraph/tree/main/contracts/governance/IController.sol#L3
pragma solidity >=0.6.12 <0.8.0; https://github.com/code-423n4/2022-10-thegraph/tree/main/contracts/staking/IStakingData.sol#L3
pragma solidity >=0.6.12 <0.8.0; https://github.com/code-423n4/2022-10-thegraph/tree/main/contracts/staking/IStaking.sol#L3
Sensitive Terms
Avoid the use of sensitive terms in favor of neutral ones. Use allowlist rather than whitelist.
https://github.com/code-423n4/2022-10-thegraph/tree/main/contracts/l2/gateway/L2GraphTokenGateway.sol#L214
https://github.com/code-423n4/2022-10-thegraph/tree/main/contracts/l2/gateway/L2GraphTokenGateway.sol#L217
https://github.com/code-423n4/2022-10-thegraph/tree/main/contracts/l2/gateway/L2GraphTokenGateway.sol#L224
https://github.com/code-423n4/2022-10-thegraph/tree/main/contracts/gateway/L1GraphTokenGateway.sol#L35
https://github.com/code-423n4/2022-10-thegraph/tree/main/contracts/gateway/L1GraphTokenGateway.sol#L63
https://github.com/code-423n4/2022-10-thegraph/tree/main/contracts/gateway/L1GraphTokenGateway.sol#L64
https://github.com/code-423n4/2022-10-thegraph/tree/main/contracts/gateway/L1GraphTokenGateway.sol#L65
https://github.com/code-423n4/2022-10-thegraph/tree/main/contracts/gateway/L1GraphTokenGateway.sol#L66
https://github.com/code-423n4/2022-10-thegraph/tree/main/contracts/gateway/L1GraphTokenGateway.sol#L95
https://github.com/code-423n4/2022-10-thegraph/tree/main/contracts/gateway/L1GraphTokenGateway.sol#L148
https://github.com/code-423n4/2022-10-thegraph/tree/main/contracts/gateway/L1GraphTokenGateway.sol#L150
https://github.com/code-423n4/2022-10-thegraph/tree/main/contracts/gateway/L1GraphTokenGateway.sol#L152
https://github.com/code-423n4/2022-10-thegraph/tree/main/contracts/gateway/L1GraphTokenGateway.sol#L153
https://github.com/code-423n4/2022-10-thegraph/tree/main/contracts/gateway/L1GraphTokenGateway.sol#L154
https://github.com/code-423n4/2022-10-thegraph/tree/main/contracts/gateway/L1GraphTokenGateway.sol#L155
https://github.com/code-423n4/2022-10-thegraph/tree/main/contracts/gateway/L1GraphTokenGateway.sol#L156
https://github.com/code-423n4/2022-10-thegraph/tree/main/contracts/gateway/L1GraphTokenGateway.sol#L160
https://github.com/code-423n4/2022-10-thegraph/tree/main/contracts/gateway/L1GraphTokenGateway.sol#L162
https://github.com/code-423n4/2022-10-thegraph/tree/main/contracts/gateway/L1GraphTokenGateway.sol#L164
https://github.com/code-423n4/2022-10-thegraph/tree/main/contracts/gateway/L1GraphTokenGateway.sol#L165
https://github.com/code-423n4/2022-10-thegraph/tree/main/contracts/gateway/L1GraphTokenGateway.sol#L166
https://github.com/code-423n4/2022-10-thegraph/tree/main/contracts/gateway/L1GraphTokenGateway.sol#L167
https://github.com/code-423n4/2022-10-thegraph/tree/main/contracts/gateway/L1GraphTokenGateway.sol#L168
https://github.com/code-423n4/2022-10-thegraph/tree/main/contracts/gateway/L1GraphTokenGateway.sol#L177
https://github.com/code-423n4/2022-10-thegraph/tree/main/contracts/gateway/L1GraphTokenGateway.sol#L180
https://github.com/code-423n4/2022-10-thegraph/tree/main/contracts/gateway/L1GraphTokenGateway.sol#L214
https://github.com/code-423n4/2022-10-thegraph/tree/main/contracts/gateway/L1GraphTokenGateway.sol#L323
https://github.com/code-423n4/2022-10-thegraph/tree/main/contracts/gateway/ICallhookReceiver.sol#L6
Revert and Require Should Have Descriptive Reason Strings
require(success); https://github.com/code-423n4/2022-10-thegraph/tree/main/contracts/upgrades/GraphProxyAdmin.sol#L34
require(success); https://github.com/code-423n4/2022-10-thegraph/tree/main/contracts/upgrades/GraphProxyAdmin.sol#L47
require(success); https://github.com/code-423n4/2022-10-thegraph/tree/main/contracts/upgrades/GraphProxyAdmin.sol#L59
require(success); https://github.com/code-423n4/2022-10-thegraph/tree/main/contracts/upgrades/GraphProxy.sol#L133
revert(ptr, size) https://github.com/code-423n4/2022-10-thegraph/tree/main/contracts/upgrades/GraphProxy.sol#L179
Missing NatSpec
Every function should have a short textual description.
In addition to the textual description, there should be a formal documentation for every parameter (@param).
There are A LOT of instances of this problem listed below. Quite a few borderline ok instances (missing formal parameters but described as text or obvious parameters) were not included in the report.
Undocumented parameter: data
https://github.com/code-423n4/2022-10-thegraph/tree/main/contracts/upgrades/GraphProxy.sol#L125-L129
Undocumented function:
https://github.com/code-423n4/2022-10-thegraph/tree/main/contracts/governance/Managed.sol#L43-L43
Undocumented function:
https://github.com/code-423n4/2022-10-thegraph/tree/main/contracts/governance/Managed.sol#L48-L48
Undocumented function:
https://github.com/code-423n4/2022-10-thegraph/tree/main/contracts/governance/Managed.sol#L52-L52
Undocumented function:
https://github.com/code-423n4/2022-10-thegraph/tree/main/contracts/governance/Managed.sol#L56-L56
Undocumented parameter: calldata
https://github.com/code-423n4/2022-10-thegraph/tree/main/contracts/gateway/L1GraphTokenGateway.sol#L251-L269
Undocumented function:
https://github.com/code-423n4/2022-10-thegraph/tree/main/contracts/curation/IGraphCurationToken.sol#L8-L8
Undocumented function:
https://github.com/code-423n4/2022-10-thegraph/tree/main/contracts/curation/IGraphCurationToken.sol#L10-L10
Undocumented function:
https://github.com/code-423n4/2022-10-thegraph/tree/main/contracts/curation/IGraphCurationToken.sol#L12-L12
Undocumented function:
https://github.com/code-423n4/2022-10-thegraph/tree/main/contracts/upgrades/IGraphProxy.sol#L6-L6
Undocumented function:
https://github.com/code-423n4/2022-10-thegraph/tree/main/contracts/upgrades/IGraphProxy.sol#L8-L8
Undocumented function:
https://github.com/code-423n4/2022-10-thegraph/tree/main/contracts/upgrades/IGraphProxy.sol#L10-L10
Undocumented function:
https://github.com/code-423n4/2022-10-thegraph/tree/main/contracts/upgrades/IGraphProxy.sol#L12-L12
Undocumented function:
https://github.com/code-423n4/2022-10-thegraph/tree/main/contracts/upgrades/IGraphProxy.sol#L14-L14
Undocumented function:
https://github.com/code-423n4/2022-10-thegraph/tree/main/contracts/upgrades/IGraphProxy.sol#L16-L16
Undocumented function:
https://github.com/code-423n4/2022-10-thegraph/tree/main/contracts/upgrades/IGraphProxy.sol#L18-L18
Undocumented function:
https://github.com/code-423n4/2022-10-thegraph/tree/main/contracts/epochs/IEpochManager.sol#L8-L8
Undocumented function:
https://github.com/code-423n4/2022-10-thegraph/tree/main/contracts/epochs/IEpochManager.sol#L12-L12
Undocumented function:
https://github.com/code-423n4/2022-10-thegraph/tree/main/contracts/epochs/IEpochManager.sol#L16-L16
Undocumented function:
https://github.com/code-423n4/2022-10-thegraph/tree/main/contracts/epochs/IEpochManager.sol#L18-L18
Undocumented function:
https://github.com/code-423n4/2022-10-thegraph/tree/main/contracts/epochs/IEpochManager.sol#L20-L20
Undocumented function:
https://github.com/code-423n4/2022-10-thegraph/tree/main/contracts/epochs/IEpochManager.sol#L22-L22
Undocumented function:
https://github.com/code-423n4/2022-10-thegraph/tree/main/contracts/epochs/IEpochManager.sol#L24-L24
Undocumented function:
https://github.com/code-423n4/2022-10-thegraph/tree/main/contracts/epochs/IEpochManager.sol#L26-L26
Undocumented function:
https://github.com/code-423n4/2022-10-thegraph/tree/main/contracts/epochs/IEpochManager.sol#L28-L28
Undocumented function:
https://github.com/code-423n4/2022-10-thegraph/tree/main/contracts/epochs/IEpochManager.sol#L30-L30
Undocumented function:
https://github.com/code-423n4/2022-10-thegraph/tree/main/contracts/governance/IController.sol#L6-L6
Undocumented function:
https://github.com/code-423n4/2022-10-thegraph/tree/main/contracts/governance/IController.sol#L10-L10
Undocumented function:
https://github.com/code-423n4/2022-10-thegraph/tree/main/contracts/governance/IController.sol#L12-L12
Undocumented function:
https://github.com/code-423n4/2022-10-thegraph/tree/main/contracts/governance/IController.sol#L14-L14
Undocumented function:
https://github.com/code-423n4/2022-10-thegraph/tree/main/contracts/governance/IController.sol#L16-L16
Undocumented function:
https://github.com/code-423n4/2022-10-thegraph/tree/main/contracts/governance/IController.sol#L20-L20
Undocumented function:
https://github.com/code-423n4/2022-10-thegraph/tree/main/contracts/governance/IController.sol#L22-L22
Undocumented function:
https://github.com/code-423n4/2022-10-thegraph/tree/main/contracts/governance/IController.sol#L24-L24
Undocumented function:
https://github.com/code-423n4/2022-10-thegraph/tree/main/contracts/governance/IController.sol#L26-L26
Undocumented function:
https://github.com/code-423n4/2022-10-thegraph/tree/main/contracts/governance/IController.sol#L28-L28
Undocumented function:
https://github.com/code-423n4/2022-10-thegraph/tree/main/contracts/token/IGraphToken.sol#L10-L10
Undocumented function:
https://github.com/code-423n4/2022-10-thegraph/tree/main/contracts/token/IGraphToken.sol#L12-L12
Undocumented function:
https://github.com/code-423n4/2022-10-thegraph/tree/main/contracts/token/IGraphToken.sol#L14-L14
Undocumented function:
https://github.com/code-423n4/2022-10-thegraph/tree/main/contracts/token/IGraphToken.sol#L18-L18
Undocumented function:
https://github.com/code-423n4/2022-10-thegraph/tree/main/contracts/token/IGraphToken.sol#L20-L20
Undocumented function:
https://github.com/code-423n4/2022-10-thegraph/tree/main/contracts/token/IGraphToken.sol#L22-L22
Undocumented function:
https://github.com/code-423n4/2022-10-thegraph/tree/main/contracts/token/IGraphToken.sol#L24-L24
Undocumented function:
https://github.com/code-423n4/2022-10-thegraph/tree/main/contracts/token/IGraphToken.sol#L28-L36
Undocumented function:
https://github.com/code-423n4/2022-10-thegraph/tree/main/contracts/token/IGraphToken.sol#L40-L40
Undocumented function:
https://github.com/code-423n4/2022-10-thegraph/tree/main/contracts/token/IGraphToken.sol#L42-L42
Undocumented function:
https://github.com/code-423n4/2022-10-thegraph/tree/main/contracts/rewards/IRewardsManager.sol#L18-L18
Undocumented function:
https://github.com/code-423n4/2022-10-thegraph/tree/main/contracts/rewards/IRewardsManager.sol#L20-L20
Undocumented function:
https://github.com/code-423n4/2022-10-thegraph/tree/main/contracts/rewards/IRewardsManager.sol#L24-L24
Undocumented function:
https://github.com/code-423n4/2022-10-thegraph/tree/main/contracts/rewards/IRewardsManager.sol#L26-L26
Undocumented function:
https://github.com/code-423n4/2022-10-thegraph/tree/main/contracts/rewards/IRewardsManager.sol#L28-L29
Undocumented function:
https://github.com/code-423n4/2022-10-thegraph/tree/main/contracts/rewards/IRewardsManager.sol#L31-L31
Undocumented function:
https://github.com/code-423n4/2022-10-thegraph/tree/main/contracts/rewards/IRewardsManager.sol#L35-L35
Undocumented function:
https://github.com/code-423n4/2022-10-thegraph/tree/main/contracts/rewards/IRewardsManager.sol#L37-L37
Undocumented function:
https://github.com/code-423n4/2022-10-thegraph/tree/main/contracts/rewards/IRewardsManager.sol#L39-L42
Undocumented function:
https://github.com/code-423n4/2022-10-thegraph/tree/main/contracts/rewards/IRewardsManager.sol#L44-L47
Undocumented function:
https://github.com/code-423n4/2022-10-thegraph/tree/main/contracts/rewards/IRewardsManager.sol#L49-L49
Undocumented function:
https://github.com/code-423n4/2022-10-thegraph/tree/main/contracts/rewards/IRewardsManager.sol#L53-L53
Undocumented function:
https://github.com/code-423n4/2022-10-thegraph/tree/main/contracts/rewards/IRewardsManager.sol#L55-L55
Undocumented function:
https://github.com/code-423n4/2022-10-thegraph/tree/main/contracts/rewards/IRewardsManager.sol#L59-L59
Undocumented function:
https://github.com/code-423n4/2022-10-thegraph/tree/main/contracts/rewards/IRewardsManager.sol#L61-L61
Undocumented function:
https://github.com/code-423n4/2022-10-thegraph/tree/main/contracts/curation/ICuration.sol#L10-L10
Undocumented function:
https://github.com/code-423n4/2022-10-thegraph/tree/main/contracts/curation/ICuration.sol#L12-L12
Undocumented function:
https://github.com/code-423n4/2022-10-thegraph/tree/main/contracts/curation/ICuration.sol#L14-L14
Undocumented function:
https://github.com/code-423n4/2022-10-thegraph/tree/main/contracts/curation/ICuration.sol#L16-L16
Undocumented function:
https://github.com/code-423n4/2022-10-thegraph/tree/main/contracts/curation/ICuration.sol#L20-L24
Undocumented function:
https://github.com/code-423n4/2022-10-thegraph/tree/main/contracts/curation/ICuration.sol#L26-L30
Undocumented function:
https://github.com/code-423n4/2022-10-thegraph/tree/main/contracts/curation/ICuration.sol#L32-L32
Undocumented function:
https://github.com/code-423n4/2022-10-thegraph/tree/main/contracts/curation/ICuration.sol#L36-L36
Undocumented function:
https://github.com/code-423n4/2022-10-thegraph/tree/main/contracts/curation/ICuration.sol#L38-L41
Undocumented function:
https://github.com/code-423n4/2022-10-thegraph/tree/main/contracts/curation/ICuration.sol#L43-L43
Undocumented function:
https://github.com/code-423n4/2022-10-thegraph/tree/main/contracts/curation/ICuration.sol#L45-L45
Undocumented function:
https://github.com/code-423n4/2022-10-thegraph/tree/main/contracts/curation/ICuration.sol#L47-L50
Undocumented function:
https://github.com/code-423n4/2022-10-thegraph/tree/main/contracts/curation/ICuration.sol#L52-L55
Undocumented function:
https://github.com/code-423n4/2022-10-thegraph/tree/main/contracts/curation/ICuration.sol#L57-L57
Undocumented function:
https://github.com/code-423n4/2022-10-thegraph/tree/main/contracts/staking/IStaking.sol#L30-L30
Undocumented function:
https://github.com/code-423n4/2022-10-thegraph/tree/main/contracts/staking/IStaking.sol#L32-L32
Undocumented function:
https://github.com/code-423n4/2022-10-thegraph/tree/main/contracts/staking/IStaking.sol#L34-L34
Undocumented function:
https://github.com/code-423n4/2022-10-thegraph/tree/main/contracts/staking/IStaking.sol#L36-L36
Undocumented function:
https://github.com/code-423n4/2022-10-thegraph/tree/main/contracts/staking/IStaking.sol#L38-L38
Undocumented function:
https://github.com/code-423n4/2022-10-thegraph/tree/main/contracts/staking/IStaking.sol#L40-L40
Undocumented function:
https://github.com/code-423n4/2022-10-thegraph/tree/main/contracts/staking/IStaking.sol#L42-L42
Undocumented function:
https://github.com/code-423n4/2022-10-thegraph/tree/main/contracts/staking/IStaking.sol#L44-L44
Undocumented function:
https://github.com/code-423n4/2022-10-thegraph/tree/main/contracts/staking/IStaking.sol#L46-L50
Undocumented function:
https://github.com/code-423n4/2022-10-thegraph/tree/main/contracts/staking/IStaking.sol#L52-L52
Undocumented function:
https://github.com/code-423n4/2022-10-thegraph/tree/main/contracts/staking/IStaking.sol#L54-L54
Undocumented function:
https://github.com/code-423n4/2022-10-thegraph/tree/main/contracts/staking/IStaking.sol#L56-L56
Undocumented function:
https://github.com/code-423n4/2022-10-thegraph/tree/main/contracts/staking/IStaking.sol#L58-L58
Undocumented function:
https://github.com/code-423n4/2022-10-thegraph/tree/main/contracts/staking/IStaking.sol#L60-L60
Undocumented function:
https://github.com/code-423n4/2022-10-thegraph/tree/main/contracts/staking/IStaking.sol#L64-L64
Undocumented function:
https://github.com/code-423n4/2022-10-thegraph/tree/main/contracts/staking/IStaking.sol#L66-L66
Undocumented function:
https://github.com/code-423n4/2022-10-thegraph/tree/main/contracts/staking/IStaking.sol#L70-L70
Undocumented function:
https://github.com/code-423n4/2022-10-thegraph/tree/main/contracts/staking/IStaking.sol#L72-L72
Undocumented function:
https://github.com/code-423n4/2022-10-thegraph/tree/main/contracts/staking/IStaking.sol#L74-L74
Undocumented function:
https://github.com/code-423n4/2022-10-thegraph/tree/main/contracts/staking/IStaking.sol#L76-L81
Undocumented function:
https://github.com/code-423n4/2022-10-thegraph/tree/main/contracts/staking/IStaking.sol#L83-L83
Undocumented function:
https://github.com/code-423n4/2022-10-thegraph/tree/main/contracts/staking/IStaking.sol#L85-L85
Undocumented function:
https://github.com/code-423n4/2022-10-thegraph/tree/main/contracts/staking/IStaking.sol#L89-L89
Undocumented function:
https://github.com/code-423n4/2022-10-thegraph/tree/main/contracts/staking/IStaking.sol#L91-L91
Undocumented function:
https://github.com/code-423n4/2022-10-thegraph/tree/main/contracts/staking/IStaking.sol#L93-L93
Undocumented function:
https://github.com/code-423n4/2022-10-thegraph/tree/main/contracts/staking/IStaking.sol#L97-L103
Undocumented function:
https://github.com/code-423n4/2022-10-thegraph/tree/main/contracts/staking/IStaking.sol#L105-L112
Undocumented function:
https://github.com/code-423n4/2022-10-thegraph/tree/main/contracts/staking/IStaking.sol#L114-L114
Undocumented function:
https://github.com/code-423n4/2022-10-thegraph/tree/main/contracts/staking/IStaking.sol#L116-L116
Undocumented function:
https://github.com/code-423n4/2022-10-thegraph/tree/main/contracts/staking/IStaking.sol#L118-L127
Undocumented function:
https://github.com/code-423n4/2022-10-thegraph/tree/main/contracts/staking/IStaking.sol#L129-L129
Undocumented function:
https://github.com/code-423n4/2022-10-thegraph/tree/main/contracts/staking/IStaking.sol#L131-L131
Undocumented function:
https://github.com/code-423n4/2022-10-thegraph/tree/main/contracts/staking/IStaking.sol#L133-L133
Undocumented function:
https://github.com/code-423n4/2022-10-thegraph/tree/main/contracts/staking/IStaking.sol#L137-L137
Undocumented function:
https://github.com/code-423n4/2022-10-thegraph/tree/main/contracts/staking/IStaking.sol#L139-L139
Undocumented function:
https://github.com/code-423n4/2022-10-thegraph/tree/main/contracts/staking/IStaking.sol#L141-L141
Undocumented function:
https://github.com/code-423n4/2022-10-thegraph/tree/main/contracts/staking/IStaking.sol#L143-L143
Undocumented function:
https://github.com/code-423n4/2022-10-thegraph/tree/main/contracts/staking/IStaking.sol#L145-L145
Undocumented function:
https://github.com/code-423n4/2022-10-thegraph/tree/main/contracts/staking/IStaking.sol#L147-L147
Undocumented function:
https://github.com/code-423n4/2022-10-thegraph/tree/main/contracts/staking/IStaking.sol#L149-L152
Undocumented function:
https://github.com/code-423n4/2022-10-thegraph/tree/main/contracts/staking/IStaking.sol#L154-L157
Undocumented function:
https://github.com/code-423n4/2022-10-thegraph/tree/main/contracts/staking/IStaking.sol#L159-L159