Sublime contest - 0xDjango's results

Issue 1 (Low) - Missing inclusive time check

https://github.com/sublime-finance/sublime-v1/blob/46536a6d25df4264c1b217bd3232af30355dcb95/contracts/PooledCreditLine/LenderPool.sol#L534

_withdrawLiquidity() requires that block.timestamp > pooledCLConstants[_id].startTime but should be >= as startTime should be inclusive of the event occurring.

Issue 2 (Low) - protocolFeeCollector must be trusted

https://github.com/sublime-finance/sublime-v1/blob/46536a6d25df4264c1b217bd3232af30355dcb95/contracts/PooledCreditLine/PooledCreditLine.sol#L915

In the event that the _borrowAsset gives control on transfer such as with an ERC777, the protocolFeeCollector is able to stop all withdrawals by throwing an error prior to the liquidity being sent to the user in the following line.

Recommendation

Ensure the penalty collector is a trusted smart contract or an EOA.

Issue #3 (Low) - Some tokens need to approve 0 first

https://github.com/sublime-finance/sublime-v1/blob/46536a6d25df4264c1b217bd3232af30355dcb95/contracts/PooledCreditLine/PooledCreditLine.sol#L755

Some tokens (like USDT) do not work when changing the allowance from an existing non-zero allowance value. They must first be approved by zero and then the actual allowance must be approved.

Issue #4 (Low) - Comment vs code conflict

https://github.com/sublime-finance/sublime-v1/blob/46536a6d25df4264c1b217bd3232af30355dcb95/contracts/PooledCreditLine/PooledCreditLine.sol#L769

The comment highlighted in the link seems to be copied from the depositCollateral() function above it. For the withdrawCollateral() function this does not make sense.

Optimization 1 - Unnecessary inclusion in >=

https://github.com/sublime-finance/sublime-v1/blob/46536a6d25df4264c1b217bd3232af30355dcb95/contracts/PooledCreditLine/PooledCreditLine.sol#L988

If _amount == _totalCurrentDebt, it's unnecessary to write it to _amount.

Optimization 2 - Add amount > 0 requirement in repay()

https://github.com/sublime-finance/sublime-v1/blob/46536a6d25df4264c1b217bd3232af30355dcb95/contracts/PooledCreditLine/PooledCreditLine.sol#L976

If you add a check require(_amount > 0), it will save a lot of unnecessary code execution within this function in the case of 0 amount payments.

Optimization 3 - Multiple instantiations of IERC20

https://github.com/sublime-finance/sublime-v1/blob/46536a6d25df4264c1b217bd3232af30355dcb95/contracts/PooledCreditLine/PooledCreditLine.sol#L915-L916

Instantiate IERC20(_borrowAsset) once and then call it multiple times.