Timeswap contest - 0xAgro's results

QA Report

Finding Summary

Low Severity

1. Unchecked Cast May Overflow

Non-Critical

1. Order of Functions Not Compliant With Solidity Docs
2. Contract Layout Voids Solidity Docs
3. Long Lines
4. Debug Left in Production Code
5. Contracts Missing @title Tag
6. Inconsistent Comment Initial Spacing
7. Inconsistent Named Returns
8. Spelling Mistakes

Low Severity

1. Unchecked Cast May Overflow

As of Solidity 0.8 overflows are handled automatically; however, not for casting. For example uint32(4294967300) will result in 4 without reversion. Consider using a SafeCast for the following code:

/packages/v2-library/src/SafeCast.sol

20:	result = uint16(value);
29:	result = uint96(value);
38:	result = uint160(value);

/packages/v2-pool/src/TimeswapV2Pool.sol

83:	return uint96(block.timestamp + durationForward);

/packages/v2-pool/src/libraries/Duration.sol

13:	return uint96(duration);

/packages/v2-token/src/TimeswapV2LiquidityToken.sol

249:	if (from != address(0)) _feesPositions[id][from].update(uint160(balanceOf(from, id)), long0FeeGrowth, long1FeeGrowth, shortFeeGrowth);
251:	if (to != address(0)) _feesPositions[id][to].update(uint160(balanceOf(to, id)), long0FeeGrowth, long1FeeGrowth, shortFeeGrowth);
277:	(uint256 long0Fees, uint256 long1Fees, uint256 shortFees) = feesPosition.feesEarnedOf(uint160(balanceOf(owner, id)), long0FeeGrowth, long1FeeGrowth, shortFeeGrowth);

Non-Critical

1. Order of Functions Not Compliant With Solidity Docs

The Solidity Style Guide suggests the following function order: constructor, receive function (if exists), fallback function (if exists), external, public, internal, private.

The following contracts are not compliant (examples are only to prove the functions are out of order NOT a full description):

• FullMath.sol: internal functions are positioned after private functions.
• TimeswapV2Pool.sol: constructor is positioned after private functions.
• Pool.sol: external functions are positioned after private functions.
• FeeCalculation.sol: internal functions are positioned after private functions.
• ERC1155Enumerable.sol: external functions are positioned after public functions.
• TimeswapV2LiquidityToken.sol: external functions are positioned after private functions.
• TimeswapV2Token.sol: public functions are positioned after private functions.
• TimeswapV2Option.sol: constructor is positioned after private functions.

2. Contract Layout Voids Solidity Docs

The Solidity Style Guide suggests the following contract layout order: Type declarations, State variables, Events, Modifiers, Functions.

The following contracts are not compliant (examples are only to prove the layout are out of order NOT a full description):

• TimeswapV2LiquidityToken.sol: State is positioned after Functions.

3. Long Lines (> 120 Characters)

Lines with greater length than 120 characters are used. The Solidity Style Guide suggests that all lines should be 120 characters or less in width.

The following lines are longer than 120 characters, it is suggested to shorten these lines:

/packages/v2-library/src/FullMath.sol

• 46, 62, 68, 77, 115, 138, 158, 181, 287.

/packages/v2-library/src/StrikeConversion.sol

• 7, 17, 27, 36, 46, 49, 50.

/packages/v2-pool/src/TimeswapV2Pool.sol

• 21, 31, 32, 34, 118, 123, 128, 133, 140, 145, 152, 165, 184, 192, 194, 198, 202, 215, 219, 231, 232, 234, 236, 240, 248, 256, 261, 267, 271, 274, 293, 295, 297, 301, 305, 313, 321, 330, 335, 338, 341, 361, 365, 381, 387, 393, 397, 400, 404, 411, 413, 421, 426, 434, 440, 444, 448, 450, 454, 461, 465, 469, 511, 517.

/packages/v2-pool/src/TimeswapV2PoolDeployer.sol

• 25, 26.

/packages/v2-pool/src/TimeswapV2PoolFactory.sol

• 37.

/packages/v2-pool/src/interfaces/ITimeswapV2Pool.sol

• 6, 16, 26, 81, 115, 126, 138, 170, 181, 189, 197, 204, 211, 218, 226, 246, 256, 261, 265, 270, 280, 295, 299, 300, 307, 311, 312, 324, 333, 344, 353, 364, 372.

/packages/v2-pool/src/interfaces/ITimeswapV2PoolDeployer.sol

• 17.

/packages/v2-pool/src/interfaces/callbacks/ITimeswapV2PoolBurnCallback.sol

• 9, 13, 20.

/packages/v2-pool/src/interfaces/callbacks/ITimeswapV2PoolRebalanceCallback.sol

• 12.

/packages/v2-pool/src/interfaces/callbacks/ITimeswapV2PoolLeverageCallback.sol

• 4, 9, 14, 18.

/packages/v2-pool/src/interfaces/callbacks/ITimeswapV2PoolMintCallback.sol

• 9, 14, 18.

/packages/v2-pool/src/interfaces/callbacks/ITimeswapV2PoolDeleverageCallback.sol

• 4, 9, 14, 18.

/packages/v2-pool/src/structs/LiquidityPosition.sol

• 41, 42, 43, 51, 55, 56, 57, 69, 79.

/packages/v2-pool/src/structs/Param.sol

• 6, 76, 96, 134, 136, 156.

/packages/v2-pool/src/structs/Pool.sol

• 25, 27, 28, 66, 75, 76, 83, 91, 101, 103, 122, 125, 139, 183, 212, 253, 279, 281, 298, 370, 371, 384, 483, 530, 532, 533, 615, 639, 653, 665, 673, 682, 687, 697, 703, 708, 715, 724.

/packages/v2-pool/src/libraries/ConstantProduct.sol

• 51, 57, 61, 66, 72, 81, 87, 128, 160, 176, 191, 206, 216, 224, 268, 277, 313, 328, 329, 334, 341, 342, 356, 359, 373, 379, 404, 406.

/packages/v2-pool/src/libraries/FeeCalculation.sol

• 27, 40, 41.

/packages/v2-pool/src/libraries/PoolFactory.sol

• 29, 43.

/packages/v2-pool/src/libraries/ConstantSum.sol

• 19, 30, 39.

/packages/v2-pool/src/libraries/DurationCalculation.sol

• 18, 26, 34, 38, 42, 43.

/packages/v2-pool/src/libraries/DurationWeight.sol

• 15.

/packages/v2-token/src/interfaces/ITimeswapV2Token.sol

• 18, 25.

/packages/v2-token/src/interfaces/ITimeswapV2LiquidityToken.sol

• 7, 13, 26, 33, 42, 59.

/packages/v2-token/src/base/ERC1155Enumerable.sol

• 47, 60, 65, 81, 94, 99.

/packages/v2-token/src/TimeswapV2LiquidityToken.sol

• 15, 21, 22, 50, 65, 70, 71, 75, 125, 143, 153, 182, 185, 199, 224, 238, 244, 246, 249, 251, 255, 259, 264, 270, 272, 277.

/packages/v2-token/src/TimeswapV2Token.sol

• 48, 66, 71, 87, 117, 146, 186, 189, 192, 205, 210, 213.

/packages/v2-token/src/interfaces/callbacks/ITimeswapV2LiquidityTokenMintCallback.sol

• 8.

/packages/v2-token/src/interfaces/callbacks/ITimeswapV2TokenMintCallback.sol

• 8.

/packages/v2-token/src/structs/FeesPosition.sol

• 24, 25, 26, 29.

/packages/v2-token/src/structs/Param.sol

• 119, 126, 149.

/packages/v2-token/src/structs/Position.sol

• 39.

/packages/v2-option/src/interfaces/ITimeswapV2Option.sol

• 5, 21, 72, 74, 130, 138, 148, 159, 169, 182, 190.

/packages/v2-option/src/interfaces/callbacks/ITimeswapV2OptionSwapCallback.sol

• 11, 15.

/packages/v2-option/src/interfaces/callbacks/ITimeswapV2OptionMintCallback.sol

• 11, 15.

/packages/v2-option/src/interfaces/callbacks/ITimeswapV2OptionCollectCallback.sol

• 11, 15.

/packages/v2-option/src/interfaces/callbacks/ITimeswapV2OptionBurnCallback.sol

• 10, 11, 15.

/packages/v2-option/src/structs/Process.sol

• 33, 37, 39.

/packages/v2-option/src/structs/Option.sol

• 11, 19, 38, 41, 49, 60, 95, 134, 191.

/packages/v2-option/src/structs/Param.sol

• 6, 15, 16, 17, 18, 38, 39, 40, 41, 60, 62, 63, 64, 65.

/packages/v2-option/src/libraries/Proportion.sol

• 12.

/packages/v2-option/src/libraries/OptionFactory.sol

• 37.

/packages/v2-option/src/TimeswapV2Option.sol

• 24, 26, 27, 85, 90, 97, 111, 118, 145, 148, 153, 159, 166, 194, 198, 205, 208, 215, 216, 220, 235, 243, 246, 279.

4. Debug Left in Production Code

Commented (and non-commented) debug lines should be taken out before production (EX. console.log).

/packages/v2-token/src/TimeswapV2Token.sol

109:            console.log("reaches right before mint in timeswapv2Tokne::mint");
170:        // console.log()

5. Contracts Missing @title NatSpec Tag

42 out of 70 of the contracts in scope are missing a @title tag. Given that 28 contracts all have a @title tag, consider adding one per the 42 remaining contracts.

SafeCast.sol, FullMath.sol, Error.sol, Math.sol, Ownership.sol, StrikeConversion.sol, CatchError.sol, TimeswapV2Pool.sol, TimeswapV2PoolFactory.sol, IOwnableTwoSteps.sol, ITimeswapV2PoolBurnCallback.sol, ITimeswapV2PoolRebalanceCallback.sol, ITimeswapV2PoolLeverageCallback.sol, ITimeswapV2PoolMintCallback.sol, ITimeswapV2PoolDeleverageCallback.sol, OwnableTwoSteps.sol, CallbackParam.sol, LiquidityPosition.sol, Param.sol, Pool.sol, PoolFactory.sol, DurationWeight.sol, PoolPair.sol, ReentrancyGuard.sol, Transaction.sol, ERC1155Enumerable.sol, ITimeswapV2LiquidityTokenMintCallback.sol, ITimeswapV2TokenMintCallback.sol, CallbackParam.sol, FeesPosition.sol, Param.sol, Position.sol, Process.sol, CallbackParam.sol, StrikeAndMaturity.sol, Option.sol, Param.sol, Proportion.sol, OptionPair.sol, OptionFactory.sol, Transaction.sol, and Position.sol are missing a @title tag.

6. Inconsistent Comment Initial Spacing

Some comments have an initial space after // or /// while others do not. It is best for code clearity to keep a consistent style.

1. The following contracts only have initial space comments (EX. // foo): IERC1155Enumerable.sol, ERC1155Enumerable.sol, TimeswapV2LiquidityToken.sol, TimeswapV2Token.sol, CallbackParam.sol, FeesPosition.sol, Param.sol, and Position.sol.
2. The following contracts have no initial space comments (EX. //foo): SafeCast.sol, Error.sol, Math.sol, Ownership.sol, StrikeConversion.sol, CatchError.sol, TimeswapV2PoolDeployer.sol, TimeswapV2PoolFactory.sol, IOwnableTwoSteps.sol, ITimeswapV2Pool.sol, ITimeswapV2PoolDeployer.sol, ITimeswapV2PoolFactory.sol, ITimeswapV2PoolBurnCallback.sol, ITimeswapV2PoolRebalanceCallback.sol, ITimeswapV2PoolLeverageCallback.sol, ITimeswapV2PoolMintCallback.sol, ITimeswapV2PoolDeleverageCallback.sol, OwnableTwoSteps.sol, CallbackParam.sol, LiquidityPosition.sol, Param.sol, ConstantProduct.sol, FeeCalculation.sol, Duration.sol, PoolFactory.sol, ConstantSum.sol, DurationCalculation.sol, DurationWeight.sol, Fee.sol, PoolPair.sol, ReentrancyGuard.sol, Transaction.sol, ITimeswapV2Token.sol, ITimeswapV2LiquidityToken.sol, ITimeswapV2LiquidityTokenMintCallback.sol, ITimeswapV2TokenMintCallback.sol, ITimeswapV2Option.sol, ITimeswapV2OptionDeployer.sol, ITimeswapV2OptionFactory.sol, ITimeswapV2OptionSwapCallback.sol, ITimeswapV2OptionMintCallback.sol, ITimeswapV2OptionCollectCallback.sol, ITimeswapV2OptionBurnCallback.sol, Process.sol, CallbackParam.sol, StrikeAndMaturity.sol, Param.sol, TimeswapV2OptionFactory.sol, Proportion.sol, OptionPair.sol, OptionFactory.sol, Transaction.sol, and Position.sol.
3. The following contracts have both: BytesLib.sol, FullMath.sol, TimeswapV2Pool.sol, NoDelegateCall.sol, Pool.sol, TimeswapV2OptionDeployer.sol, Option.sol, NoDelegateCall.sol, and TimeswapV2Option.sol.

7. Inconsistent Named Returns

Some functions use named returns and others do not. It is best for code clearity to keep a consistent style.

1. The following contracts only have named returns (EX. returns(uint256 foo)): SafeCast.sol, FullMath.sol, Math.sol, TimeswapV2PoolDeployer.sol, LiquidityPosition.sol, Pool.sol, PoolFactory.sol, ConstantSum.sol, DurationCalculation.sol, DurationWeight.sol, TimeswapV2Token.sol, FeesPosition.sol, TimeswapV2OptionDeployer.sol, Option.sol, and OptionFactory.sol.
2. The following contracts only have non-named returns (EX. returns(uint256)): BytesLib.sol, StrikeConversion.sol, CatchError.sol, Duration.sol, ERC1155Enumerable.sol, Position.sol, and Proportion.sol.
3. The following contracts have both: TimeswapV2Pool.sol, TimeswapV2PoolFactory.sol, ConstantProduct.sol, FeeCalculation.sol, TimeswapV2LiquidityToken.sol, TimeswapV2OptionFactory.sol, and TimeswapV2Option.sol.

8. Spelling Mistakes

There are some spelling mistakes throughout the codebase. Consider fixing all spelling mistakes.

/packages/v2-library/src/FullMath.sol

• The word significant is misspelled as signficant.
• The word preconditions is misspelled as precoditions.

/packages/v2-library/src/StrikeConversion.sol

• The word token is misspelled as toekn.

/packages/v2-pool/src/TimeswapV2Pool.sol

• The word overridden is misspelled as overidden.
• The word recipients is misspelled as receipients (1).
• The word recipient is misspelled as receipient (1).
• The word recipient is misspelled as receipient (2).
• The word recipient is misspelled as receipient (3).
• The word recipients is misspelled as receipients (2).
• The word recipient is misspelled as receipient (4).
• The word recipients is misspelled as receipients (3).
• The word recipients is misspelled as receipients (4).

/packages/v2-pool/src/interfaces/ITimeswapV2Pool.sol

• The word recipient is misspelled as receipeint (1).
• The word recipient is misspelled as receipeint (2).
• The word recipient is misspelled as receipient (1).
• The word recipient is misspelled as receipient (2).
• The word recipient is misspelled as receipient (3).
• The word recipient is misspelled as receipient (4).
• The word recipient is misspelled as receipient (5).
• The word recipient is misspelled as receipient (6).
• The word recipient is misspelled as receipient (7).
• The word recipient is misspelled as receipient (8).
• The word recipient is misspelled as receipient (9).
• The word recipient is misspelled as receipient (10).
• The word recipient is misspelled as receipient (11).
• The word recipient is misspelled as receipient (12).
• The word recipient is misspelled as receipient (13).
• The word else is misspelled as ekse.
• The word recipient is misspelled as receipient (14).
• The word recipient is misspelled as receipient (15).
• The word recipient is misspelled as receipient (16).
• The word transferred is misspelled as transferrred (1).
• The word transferred is misspelled as transferrred (2).
• The word transferred is misspelled as transferrred (3).

/packages/v2-pool/src/interfaces/callbacks/ITimeswapV2PoolRebalanceCallback.sol

• The word recipient is misspelled as receipient.

/packages/v2-pool/src/interfaces/callbacks/ITimeswapV2PoolLeverageCallback.sol

• The word recipients is misspelled as receipients.

/packages/v2-pool/src/interfaces/callbacks/ITimeswapV2PoolMintCallback.sol

• The word positions is misspelled as positionss.
• The word recipient is misspelled as receipient.

/packages/v2-pool/src/interfaces/callbacks/ITimeswapV2PoolDeleverageCallback.sol

• The word recipient is misspelled as receipient.

/packages/v2-pool/src/structs/Param.sol

• The word recipient is misspelled as receipient (1).
• The word recipient is misspelled as receipient (2).
• The word recipient is misspelled as receipient (3).
• The word recipient is misspelled as receipient (4).
• The word recipient is misspelled as receipient (5).
• The word recipient is misspelled as receipient (6).
• The word recipient is misspelled as receipient (7).
• The word recipient is misspelled as receipient (8).
• The word recipient is misspelled as receipient (9).
• The word recipient is misspelled as receipient (10).
• The word recipient is misspelled as receipient (11).

/packages/v2-pool/src/structs/Pool.sol

• The word recipient is misspelled as receipient (1).
• The word recipient is misspelled as receipient (2).
• The word recipient is misspelled as receipient (3).
• The word transferred is misspelled as transferrred (1).
• The word transferred is misspelled as transferrred (2).
• The word transferred is misspelled as transferrred (3).

/packages/v2-pool/src/libraries/ConstantProduct.sol

• The word liquidity is misspelled as liqudity.
• The word discriminant is misspelled as disriminant.

/packages/v2-pool/src/libraries/PoolFactory.sol

• The word retrieved is misspelled as retreived (1).
• The word retrieved is misspelled as retreived (2).
• The word retrieved is misspelled as retreived (3).
• The word retrieved is misspelled as retreived (4).

/packages/v2-token/src/base/ERC1155Enumerable.sol

• The word overridden is misspelled as overidden (1).
• The word overridden is misspelled as overidden (2).
• The word overridden is misspelled as overidden (3).
• The word overridden is misspelled as overidden (4).

/packages/v2-token/src/structs/CallbackParam.sol

• The word parameter is misspelled as paramater (1).
• The word parameter is misspelled as paramater (2).
• The word initialize is misspelled as initalize.

/packages/v2-token/src/structs/Param.sol

• The word parameter is misspelled as paramater (1).
• The word recipient is misspelled as receipient (1).
• The word recipient is misspelled as receipient (2).
• The word recipient is misspelled as receipient (3).
• The word parameter is misspelled as paramater (2).
• The word initialize is misspelled as initalize (1).
• The word parameter is misspelled as paramater (3).
• The word recipient is misspelled as receipient (4).
• The word parameter is misspelled as paramater (4).
• The word recipient is misspelled as receipient (5).
• The word initialize is misspelled as initalize (2).
• The word parameter is misspelled as paramater (5).
• The word recipient is misspelled as receipient (6).
• The word initialize is misspelled as initalize (3).

/packages/v2-option/src/interfaces/ITimeswapV2Option.sol

• The word recipient is misspelled as receipient (1).
• The word recipient is misspelled as receipient (2).
• The word recipient is misspelled as receipient (3).
• The word recipient is misspelled as receipient (4).
• The word recipient is misspelled as receipient (5).
• The word recipient is misspelled as receipient (6).
• The word recipient is misspelled as receipient (7).
• The word recipient is misspelled as receipient (8).
• The word recipient is misspelled as receipient (9).
• The word recipient is misspelled as receipient (10).
• The word recipient is misspelled as receipient (11).

/packages/v2-option/src/interfaces/callbacks/ITimeswapV2OptionSwapCallback.sol

• The word recipients is misspelled as receipients.

/packages/v2-option/src/interfaces/callbacks/ITimeswapV2OptionMintCallback.sol

• The word recipients is misspelled as receipients.

/packages/v2-option/src/interfaces/callbacks/ITimeswapV2OptionCollectCallback.sol

• The word recipients is misspelled as receipients.

/packages/v2-option/src/interfaces/callbacks/ITimeswapV2OptionBurnCallback.sol

• The word recipients is misspelled as receipients.

/packages/v2-option/src/structs/Process.sol

• The word multiple is misspelled as multple.

/packages/v2-option/src/structs/Param.sol

• The word recipient is misspelled as receipient (1).
• The word recipient is misspelled as receipient (2).
• The word recipient is misspelled as receipient (3).
• The word recipient is misspelled as receipient (4).
• The word recipient is misspelled as receipient (5).
• The word callback is misspelled as calback (1).
• The word recipient is misspelled as receipient (6).
• The word recipient is misspelled as receipient (7).
• The word recipient is misspelled as receipient (8).
• The word recipient is misspelled as receipient (9).
• The word callback is misspelled as calback (2).

/packages/v2-option/src/TimeswapV2Option.sol

• The word maturities is misspelled as maturies (1).
• The word maturities is misspelled as maturies (2).
• The word overridden is misspelled as overidden.