Juicebox Buyback Delegate - MohammedRizwan's results

Summary

Low Risk Issues

Non-Critical Issues

Low Risk Issues

[L‑01] For immutable variables, Zero address checks are missing in constructor

Zero address check validations should be used in the constructors, to avoid the risk of setting a immutable storage variable as zero address at the time of deployment. If bymistake, address(0) is set it will cause redeployment of contract.

There are 4 instances of this issue:

File: juice-buyback/contracts/JBXBuybackDelegate.sol

118    constructor(
119        IERC20 _projectToken,
120        IWETH9 _weth,
121        IUniswapV3Pool _pool,
122        IJBPayoutRedemptionPaymentTerminal3_1 _jbxTerminal
123    ) {
124        projectToken = _projectToken;
125        pool = _pool;
126        jbxTerminal = _jbxTerminal;
127        _projectTokenIsZero = address(_projectToken) < address(_weth);
128        weth = _weth;
129    }

Link to code

Recommended Mitigation steps

Add address(0) validation check in constructor.

File: juice-buyback/contracts/JBXBuybackDelegate.sol

    constructor(
        IERC20 _projectToken,
        IWETH9 _weth,
        IUniswapV3Pool _pool,
        IJBPayoutRedemptionPaymentTerminal3_1 _jbxTerminal
    ) {
+       require(address(_projectToken) != address(0), "invalid address");
+       require(address(_weth) != address(0), "invalid address");
+       require(address(_pool) != address(0), "invalid address");
+       require(address(_jbxTerminal) != address(0), "invalid address");
        projectToken = _projectToken;
        pool = _pool;
        jbxTerminal = _jbxTerminal;
        _projectTokenIsZero = address(_projectToken) < address(_weth);
        weth = _weth;
    }

Non-Critical Issues

[N‑01] Use latest version of PRBMath library

The contract uses old version of PRBMath library 3.7.0. The latest version v4.0.0 has lots of fixes and some breaking changes. It is recommended to use latest version of PRBMath library.

Link to latest release features

There is 1 instance of this issue.

File: /juice-buyback/package.json

 "@paulrberg/contracts": "^3.7.0",

[N‑02] Use a more recent version of Solidity

For security and optimization, it is best practice to use the latest Solidity version. For the security fix list in the versions: Link to reference

There is 1 instance of this issue.

File: juice-buyback/contracts/JBXBuybackDelegate.sol

pragma solidity ^0.8.16;