prePO contest - 0xwags's results

Even though a require statement (that redemption fee!=0) is inconsequential on its own. Its omission would be detrimental in the case of : https://github.com/code-423n4/2022-03-prepo/blob/f63584133a0329781609e3f14c3004c1ca293e71/contracts/core/PrePOMarket.sol#L167

Same for:

https://github.com/code-423n4/2022-03-prepo/blob/f63584133a0329781609e3f14c3004c1ca293e71/contracts/core/Collateral.sol#L166

In setRedemptionFee(), there's only a requirement that redemption fee is less than FEE_LIMIT but the check on line 167 would still pass if the redemption fee was accidentally set to 0 (it still fulfills the condition that it is less than the Fee limit) but this causes no fee to be sent to the treasury and the collateralOwed (which is sent to msg.sender) would be much larger than expected.

PS. After speaking to one of the devs, it was stated that this issue wouldn't be valid as it is just to prevent small amounts being passed in to avoid a fee. It wasn't clear from the documentation that the team wanted to implement a zero fee (From #mloch137: ”We want to be able to set the redemption fee to zero if we wish, that is as intended”). I was told to proceed in submitting this issue as other team members might consider it to be valid.

Use unchecked block to reduce gas.

https://github.com/code-423n4/2022-03-prepo/blob/f63584133a0329781609e3f14c3004c1ca293e71/contracts/core/PrePOMarket.sol#L146

Since the value will increase after the deposit, it'd be feasible to use it here as well :

https://github.com/code-423n4/2022-03-prepo/blob/f63584133a0329781609e3f14c3004c1ca293e71/contracts/core/Collateral.sol#L79

https://github.com/code-423n4/2022-03-prepo/blob/f63584133a0329781609e3f14c3004c1ca293e71/contracts/core/Collateral.sol#L155

Also :

https://github.com/code-423n4/2022-03-prepo/blob/f63584133a0329781609e3f14c3004c1ca293e71/contracts/core/CollateralDepositRecord.sol#L47

https://github.com/code-423n4/2022-03-prepo/blob/f63584133a0329781609e3f14c3004c1ca293e71/contracts/core/CollateralDepositRecord.sol#L52

Default value for uint256 is zero, no need to assign it :

https://github.com/code-423n4/2022-03-prepo/blob/f63584133a0329781609e3f14c3004c1ca293e71/contracts/core/AccountAccessController.sol#L55

https://github.com/code-423n4/2022-03-prepo/blob/f63584133a0329781609e3f14c3004c1ca293e71/contracts/core/AccountAccessController.sol#L44

https://github.com/code-423n4/2022-03-prepo/blob/f63584133a0329781609e3f14c3004c1ca293e71/contracts/core/Collateral.sol#L81