QA Report

[code423n4]

See the markdown file with the details of this report here.

[c4-judge]

Picodes marked the issue as grade-a

[c4-judge]

Picodes marked the issue as selected for report

[ramenforbreakfast]

Was asked to repost this from the C4 Discord.

Thank you for preparing the review and also including our discussions for clarification on certain issues! The following are things I spotted while reviewing:

• L-07 I am not sure why that is here given that even in our architecture diagram, ownership is behind a governance multi-sig? Please remove this or at least add the note that we already plan to govern via a multi-sig.
• N-05 "Function writing that does not comply with Solidity Style Guide" has some weird formatting, doesn't seem intentional.
• N-06 Could you please add a note here that we plan to use a timelock in production?
• N-09 I am confused, this seems to be an issue referencing something not relevant to our codebase? Adding this seems to have been a mistake?
• N-12 I don't think I caught this one, but our repo does follow < 80 char width guidelines, the formatting was changed to > 80 specifically for the audit repo. Please remove this one.

[Picodes]

L07: report is valid (there is a centralization risk) although it is not stated in the repo that owner role isn’t behind a multi-sig so this can be amended for the report. L-10: invalid as upgradeable contracts are deployed and initialized in one transaction L-4, L-11, and NC-1 are the same issue, we can keep only NC-1 for the report N-9: invalid N-12: per the sponsor comments seems invalid on their main repo, but valid on the audit repo

The rest can be kept for the report!

[liveactionllama]

Just a note that C4 is excluding the invalid entries (noted by the judge above) from the official report.

[ramenforbreakfast]

What about N-05 nad N-12? is the formatting correct? Seems strange to me that "Function writing" and "inherited state variables" are formatted with backticks.

N-11 has "Solidity Style Guide" in the title as well, but is not formatted in the same vein, seems to be a mistake.

For the Non-Critical Issues Summary Table, there is a typo "All Conracts" instead of "All Contracts"