Volt Protocol contest - 0xDjango's results

Issue 1 (Low) - All function address inputs should verify != 0

There are a few instances where function address inputs are not checked for the zero address.

https://github.com/code-423n4/2022-03-volt/blob/f1210bf3151095e4d371c9e9d7682d9031860bbd/contracts/vcon/Vcon.sol#L99-L104 https://github.com/code-423n4/2022-03-volt/blob/f1210bf3151095e4d371c9e9d7682d9031860bbd/contracts/oracle/ScalingPriceOracle.sol#L88 https://github.com/code-423n4/2022-03-volt/blob/f1210bf3151095e4d371c9e9d7682d9031860bbd/contracts/peg/NonCustodialPSM.sol#L297

Issue 2 (Low) - Code vs Comment conflict

The comments refer to FEI, but the contract pertains to VOLT.

Code

https://github.com/code-423n4/2022-03-volt/blob/f1210bf3151095e4d371c9e9d7682d9031860bbd/contracts/volt/Volt.sol#L7-L38

Issue 3 (Low) - Floating Pragma

All contracts contain a floating pragma. It is recommended to deploy contracts with a single, specific compiler version to reduce the risk of compiler version-related bugs.

Issue 4 (Low) - Duration must be greater than 16 days

If duration is set to less than 16 days, run the possibility that the _updateCPIData() function can be run multiple times in the same month. This would cause incorrect functionality within the _addNewMonth() function.

Code

https://github.com/code-423n4/2022-03-volt/blob/f1210bf3151095e4d371c9e9d7682d9031860bbd/contracts/utils/Timed.sol#L71

Issue 5 (Low) - Inconsistent Individual vs Global bufferCap requirements

In the constructor, the individual bufferCap must be less than the global bufferCap. In the updateMaxBufferCap() function, the individual bufferCap can be less than or equal to global bufferCap.

Code

https://github.com/code-423n4/2022-03-volt/blob/f1210bf3151095e4d371c9e9d7682d9031860bbd/contracts/utils/MultiRateLimited.sol#L56-L59

Issue 6 (Non-critical) - Potentially incorrect event emissions

The Pause/Unpause Redeem and Mint functions will emit an event despite the possibility that the function doesn't do anything. E.g. If you pauseMint() 5 times in a row, 5 events will be emitted but you actually only paused once. These functions should check that the current state is the opposite of the function action, e.g. if you want to pause, require !paused.

Code

https://github.com/code-423n4/2022-03-volt/blob/f1210bf3151095e4d371c9e9d7682d9031860bbd/contracts/peg/NonCustodialPSM.sol#L130-L151

Issue 7 (Non-critical) - Event emission can lack detail

The _updateAddress() function can be used to update the rateLimit or the bufferCap, but the event emission only describes the rateLimit change. If only the bufferCap is changed, the event emission will simply describe no change to rateLimit.

Code

https://github.com/code-423n4/2022-03-volt/blob/f1210bf3151095e4d371c9e9d7682d9031860bbd/contracts/utils/MultiRateLimited.sol#L282-L287

Issue 8 (Non-critical) - Comment Issue: Add vs Update

Comment says the function adds an address, instead it updates an existing address.

Code

https://github.com/code-423n4/2022-03-volt/blob/f1210bf3151095e4d371c9e9d7682d9031860bbd/contracts/utils/MultiRateLimited.sol#L128

Issue 9 (Non-critical) - SafeMath Continuity

Should use SafeMath in same way as performed in the _getMintAmountOut() function right above it.

Code

https://github.com/code-423n4/2022-03-volt/blob/f1210bf3151095e4d371c9e9d7682d9031860bbd/contracts/peg/NonCustodialPSM.sol#L382-L386