[N-2] Use allowlist/denylist rather than blacklist/whitelist
L1GraphTokenGateway.sol:35: mapping(address => bool) public callhookWhitelist;
L1GraphTokenGateway.sol:63: // Emitted when an address is added to the callhook whitelist
L1GraphTokenGateway.sol:64: event AddedToCallhookWhitelist(address newWhitelisted);
L1GraphTokenGateway.sol:65: // Emitted when an address is removed from the callhook whitelist
L1GraphTokenGateway.sol:66: event RemovedFromCallhookWhitelist(address notWhitelisted);
L1GraphTokenGateway.sol:95: * - whitelisted callhook callers using addToCallhookWhitelist
L1GraphTokenGateway.sol:148: * @dev Adds an address to the callhook whitelist.
L1GraphTokenGateway.sol:150: * @param _newWhitelisted Address to add to the whitelist
L1GraphTokenGateway.sol:152: function addToCallhookWhitelist(address _newWhitelisted) external onlyGovernor {
L1GraphTokenGateway.sol:153: require(_newWhitelisted != address(0), "INVALID_ADDRESS");
L1GraphTokenGateway.sol:154: require(!callhookWhitelist[_newWhitelisted], "ALREADY_WHITELISTED");
L1GraphTokenGateway.sol:155: callhookWhitelist[_newWhitelisted] = true;
L1GraphTokenGateway.sol:156: emit AddedToCallhookWhitelist(_newWhitelisted);
L1GraphTokenGateway.sol:160: * @dev Removes an address from the callhook whitelist.
L1GraphTokenGateway.sol:162: * @param _notWhitelisted Address to remove from the whitelist
L1GraphTokenGateway.sol:164: function removeFromCallhookWhitelist(address _notWhitelisted) external onlyGovernor {
L1GraphTokenGateway.sol:165: require(_notWhitelisted != address(0), "INVALID_ADDRESS");
L1GraphTokenGateway.sol:166: require(callhookWhitelist[_notWhitelisted], "NOT_WHITELISTED");
L1GraphTokenGateway.sol:167: callhookWhitelist[_notWhitelisted] = false;
L1GraphTokenGateway.sol:168: emit RemovedFromCallhookWhitelist(_notWhitelisted);
L1GraphTokenGateway.sol:177: * Also note that whitelisted senders (some protocol contracts) can include additional calldata
L1GraphTokenGateway.sol:180: * never succeeds. This requires extra care when adding contracts to the whitelist, but is necessary to ensure that
L1GraphTokenGateway.sol:214: extraData.length == 0 || callhookWhitelist[msg.sender] == true,
L1GraphTokenGateway.sol:323: * @param _data Additional call data for the L2 transaction, which must be empty unless the caller is whitelisted
ICallhookReceiver.sol:6: * be whitelisted by the governor, but also implement this interface that contains
L2GraphTokenGateway.sol:214: * Note that whitelisted senders (some protocol contracts) can include additional calldata
L2GraphTokenGateway.sol:217: * never succeeds. This requires extra care when adding contracts to the whitelist, but is necessary to ensure that
L2GraphTokenGateway.sol:224: * @param _data Extra callhook data, only used when the sender is whitelisted
Non critical
[N-1]
require()
/revert()
statements should have descriptive reason strings[N-2] Use allowlist/denylist rather than blacklist/whitelist
[N-3] Use more recent version of solidity
Low
[L-01]
abi.encodePacked()
should not be used with dynamic types when passing the result to a hash function such askeccak256()