QA Report

[c4-submissions]

See the markdown file with the details of this report here.

[c4-pre-sort]

raymondfam marked the issue as sufficient quality report

[alex-ppg]

The report contains code segments without clearly marking which contract they are from which should be avoided as it significantly degrades the quality of the report. The overall quality of the report is C as it does not contain valid/useful findings.

• Hardcoded Constants: This finding is incorrect as the constants represent hashes which are used as keys in the AddressProviderService::_getRegistry function, not as addresses. As such, it is incorrect.
• No Rate Limiting: The PolicyRegistry::updatePolicy function is solely invoke-able by either the Gnosis Safe deployer, the Gnosis Safe themselves, or parties that wish to change their own policy. A compromise is not possible in such a case and generally, rate limits are ill-advised and will never realistically prevent gas cost surges in blockchain networks.
• Unclear Revert Reasons: The errors listed are quite clear, a PolicyCommitInvalid relates to the commit of the policy being invalid whereas an UnauthorizedPolicyUpdate relates to the caller not possessing the necessary authorization.
• Overflow Risk in _genNonce: The contract is compiled with built-in safe arithmetics as a Solidity version 0.8.X is utilized. Additionally, a sequentially incremented nonce will not realistically overflow.

[c4-judge]

alex-ppg marked the issue as grade-c