sherlock-audit / 2024-06-boost-aa-wallet-judging

3 stars 1 forks source link

Stable Teal Wolf - ### [L-1] Redundant Code Removal and Magic Number Replacement in `ERC20VariableIncentive` contract. #476

Closed sherlock-admin2 closed 1 month ago

sherlock-admin2 commented 1 month ago

Stable Teal Wolf

Low/Info

[L-1] Redundant Code Removal and Magic Number Replacement in ERC20VariableIncentive contract.

Description:

  1. Redundant _initializeOwner Call Removal: The contract previously contained a redundant call to the _initializeOwner function within the initialize function. This redundant call did not serve any additional purpose and was removed to clean up the code.

  2. Replacement of Magic Number 1e18 with Named Constant DECIMALS: The magic number 1e18 used for scaling has been replaced with a named constant DECIMALS to enhance code readability and maintainability.

Impact:

  1. The removal of the redundant call has no functional impact on the contract. It simply improves code readability and reduces unnecessary operations.

  2. Replacing the magic number with a named constant improves the clarity of the code, making it easier to understand and maintain. This change does not alter the contract’s behavior.

Proof of Concept (PoC):

PoC ```javascript // Redundant `_initializeOwner` Call Removal // Before function initialize(bytes calldata data_) public override initializer { _initializeOwner(msg.sender); // other initialization code _initializeOwner(msg.sender); // Redundant call } // After function initialize(bytes calldata data_) public override initializer { _initializeOwner(msg.sender); // other initialization code } // Replacement of Magic Number 1e18 // Before uint256 claimAmount = reward * signedAmount / 1e18; // After uint256 constant DECIMALS = 1e18; uint256 claimAmount = reward * signedAmount / DECIMALS; ```

Recommended Mitigation:

  1. Ensure that all redundant or unnecessary code is removed during development to maintain a clean and efficient codebase.

  2. Use named constants for all magic numbers in the code. This practice enhances readability and makes it easier to adjust values if needed.

sherlock-admin2 commented 1 month ago

The protocol team fixed this issue in the following PRs/commits: https://github.com/boostxyz/boost-protocol/pull/200