FEI and TRIBE Redemption contest - CertoraInc's results

QA Report

• Pragmas should be locked to a specific compiler version, to avoid contracts getting deployed using a different version, which may have a greater risk of undiscovered bugs.
• The pause variables in the SimpleFeiDaiPSM contract are constant, which means the contract can't be pause by modifying these variables. It will be better to add a pause functionality instead of pausing it only through revoking of the MINTER role, which will cause transaction to revert if the users won't know that it was pause. If you'll implement that pause mechanism, the users can simply check the value of paused and see if the contract is active or not.
• The dripping mechanism in the MerkleRedeemerDripper contract creates kind of race condition, which can lead to users front running to use the current drip's balance. It will be better to implement another mechanism to avoid users competing for the balance.
• Consider adding checks to the redeemBase parameter in the TribeRedeemer contract - this variable represents the amount of TRIBE that can be redeemed, however it is not checked and can potentially be any value. Check like redeemBase > 0 (or even redeemBase > 1e10 like in the RariMerkleRedeemer contract) can be added to insure this value is correct.
• The SimpleFeiDaiPSM doesn't implement all the functions from the interfaces that he should implement (the IPCVDeposit interface for example)