veToken Finance contest - BouSalman's results

QA Report for the vetoken protocol

This report do list low-risk and non-critical findings presented in the protocol codebase, these findings do not effect any assets connected to users or the protocol. However these issues are related to coding and security best practices.

Findings

Missing message in require statements

There is some require statements used inside the protocol codebase however No message were provided. It's advised to provide a message with the require statement to alert the users and state what cause this error.

https://github.com/code-423n4/2022-05-vetoken/blob/2d7cd1f6780a9bcc8387dea8fecfbd758462c152/contracts/VE3DLocker.sol#L154-L155 https://github.com/code-423n4/2022-05-vetoken/blob/2d7cd1f6780a9bcc8387dea8fecfbd758462c152/contracts/VE3DLocker.sol#L165-L167 https://github.com/code-423n4/2022-05-vetoken/blob/2d7cd1f6780a9bcc8387dea8fecfbd758462c152/contracts/VE3DLocker.sol#L180

Numbers presentation

When dealing with big numbers developers can make a use of scientific notation format to increase code readability, However there is occurrences in the protocol codebase where double asterisk is used instead of scientific notation.

https://github.com/code-423n4/2022-05-vetoken/blob/2d7cd1f6780a9bcc8387dea8fecfbd758462c152/contracts/helper/FixedPoint.sol#L59

Function type from public to external

Some of the implemented functions inside the protocol are of type Public, However these functions are not used within the contracts. functions like this should be labeled external to have a better code readability.

https://github.com/code-423n4/2022-05-vetoken/blob/2d7cd1f6780a9bcc8387dea8fecfbd758462c152/contracts/VoterProxy.sol#L199

Safe minting function

It's advised to make a use of _safemint() function when possible instead of the regular _mint() since the later can't distinguish the recipient, and this may lead to loss of assets if no logic implemented in the recipient to handle the received assets.

https://github.com/code-423n4/2022-05-vetoken/blob/2d7cd1f6780a9bcc8387dea8fecfbd758462c152/contracts/DepositToken.sol#L29 https://github.com/code-423n4/2022-05-vetoken/blob/2d7cd1f6780a9bcc8387dea8fecfbd758462c152/contracts/token/VE3Token.sol#L29 https://github.com/code-423n4/2022-05-vetoken/blob/2d7cd1f6780a9bcc8387dea8fecfbd758462c152/contracts/token/VeToken.sol#L27