hats-finance / Blast-Futures-Exchange-0x97895c329b950755566ddcdad3395caaea395074

0 stars 0 forks source link

SPDX license used in contracts deviates from readme #12

Open hats-bug-reporter[bot] opened 4 months ago

hats-bug-reporter[bot] commented 4 months ago

Github username: -- Twitter username: -- Submission hash (on-chain): 0x9bb82cef3f97255cacce68209a9e6d8e06c7032f755fc4e165fd9fa3f3e24c98 Severity: low

Description: Description\

The github repo of Blast-Futures-Exchange readme specifically mentions,

Blast Futures Exchange is released under the MIT License.

However, this is not correct. See below contracts using different licenses.

1) Bfx.sol - // SPDX-License-Identifier: BUSL-1.1 2) BfxVault.sol- // SPDX-License-Identifier: BUSL-1.1 3) EIP712Verifier.sol- // SPDX-License-Identifier: MIT 4) IPoolDeposit.sol- // SPDX-License-Identifier: BUSL-1.1 5) IVault.sol- // SPDX-License-Identifier: BUSL-1.1 6)PoolDeposit.sol- // SPDX-License-Identifier: BUSL-1.1

only one contract has MIT license and it must be noted that making source code available always touches on legal problems with regards to copyright.

The Business Source License(BUSL) is not an Open Source license and MIT license gives express permission for users to reuse code for any purpose.

Per readme, It can be seen that the code wants to open source, Therefore, all contracts should be MIT licensed.

The issue is idenified as low severity with below contest rules,

Issues where the behavior of the contracts differs from the intended behavior (as described in the docs and by common sense), but no funds are at risk.

Recommendation\

Keep the license type same in all contracts, if readme info is correct then all contracts should have MIT license.

alex-sumner commented 4 months ago

The inconsistency in licence notices is noted, and should be corrected. However the present exercise is a security audit of the code, and the licence notice has no effect on contract behavior.

alex-sumner commented 4 months ago

Moving to low as there is a mistake which is correctly identified here.