Canto v2 contest - Funen's results

1. Undeclared totalCash can be removed from comment since not used in actual code

https://github.com/Plex-Engineer/lending-market-v2/blob/443a8c0fed3c5018e95f3881a31b81a555c42b2d/contracts/CNote.sol#L55-L57

             *  exchangeRate = (totalCash + totalBorrows - totalReserves) / totalSupply
             */
            uint cashPlusBorrowsMinusReserves = totalBorrows - totalReserves;// totalCash in cNote Lending Market is zero, thus it is not factored 
            into the exchangeRate

Since exchangeRate = totalBorrows - totalReserves / totalSupply; was used so it can be removed from comment.

2. require()/revert() statements should have reason strings

1.) TreasuryDelegator.sol Line.13

        require(admin_ != address(0));

2.) File : CNote.sol Line.74

        require(address(_accountant) != address(0)); 

3.) File : CNote.sol Line.121

        require(address(_accountant) != address(0)); //check that the accountant has been set

4.) File : AccountantDelegator.sol Line.22

        require(admin_ != address(0));

5.) File : Proposal-Store.sol Line.44

        require(msg.sender == UniGovModAcct);

3. Make sure using modifier require for better used

https://github.com/Plex-Engineer/lending-market-v2/blob/443a8c0fed3c5018e95f3881a31b81a555c42b2d/contracts/Stableswap/BaseV1-periphery.sol#L87

        //require(deadline >= block.timestamp, "BaseV1Router: EXPIRED");

the ensure modifier requires that the swap transaction is executed before the given deadline, so rather than be an comment it can be used for better use.

4. Use SPDX license identifier

For some contracts that was not used SPDX license identifier in source file. Before publishing, consider adding a comment containing "SPDX-License-Identifier: <SPDX-License>" to each source file. Use "SPDX-License-Identifier: UNLICENSED" for non-open-source code

Occurances contract : CNote.sol, NoteInterest.sol, TreasuryInterfaces.sol), TreasuryDelegate.sol, TreasuryDelegator.sol

5. Avoid Floatin Pragma's

Since it was used ^0.8.10. As the compiler can be use as 0.8.10 and consider locking at this version the same as another. It can be consider using locking the pragma version whenever possible and avoid using a floating pragma in the final deployment. Since it can be problematic, if there are publicly disclosed bugs and issues that affect the current compiler version used.

5. Typo Reason String

https://github.com/Plex-Engineer/lending-market-v2/blob/443a8c0fed3c5018e95f3881a31b81a555c42b2d/contracts/WETH.sol#L69

        require(_balanceOf[src] >= wad, "WETH::transfeFrom");

changed to transferFrom

6. Typo Comment

1.) https://github.com/Plex-Engineer/lending-market-v2/blob/443a8c0fed3c5018e95f3881a31b81a555c42b2d/contracts/Stableswap/BaseV1-core.sol#L45

CREATE2 // change to create

1. Value can be set as immutable

1.) File : Proposal-Store.sol Proposal-Store.sol

address private UniGovModAcct;

2. sing short reason string can be used for saving more gas

Every reason string takes at least 32 bytes. Use short reason strings that fits in 32 bytes or it will become more expensive.

Tool Used

Manual Review

Occurances

main/contracts/NoteInterest.sol#L167 "only the admin may set the base rate"; -> change "only admin"
main/contracts/NoteInterest.sol#L180 "only the admin may set the adjuster coefficient" -> change "only admin"
main/contracts/NoteInterest.sol#L193 "only the admin may set the update frequency" -> change "only admin"
main/contracts/Stableswap/BaseV1-periphery.sol#L104 "BaseV1Router: IDENTICAL_ADDRESSES" -> change "ID" //Identical_Addresses
main/contracts/CNote.sol#L105 "Accountant has not been correctly supplied" -> change "ANCS" //Accountant not correct supplied
main/contracts/CNote.sol#L147 "TOKEN_TRANSFER_OUT_FAILED"
main/contracts/CNote.sol#L148 "cNote::doTransferOut: TransferOut Failed"
main/contracts/Treasury/TreasuryDelegator.sol#L31 "GovernorBravoDelegator::setImplementation: admin only" -> change "only admin"
main/contracts/Treasury/TreasuryDelegator.sol#L32 "GovernorBravoDelegator::setImplementation: invalid implementation address" -> "inv_addr"