Fraxlend (Frax Finance) contest - RoiEvenHaim's results

Issues found

Don't Initialize Variables with Default Value

2022-08-frax\src\contracts\FraxlendPair.sol::289 => for (uint256 i = 0; i < _lenders.length; i++) {
2022-08-frax\src\contracts\FraxlendPair.sol::308 => for (uint256 i = 0; i < _borrowers.length; i++) {
2022-08-frax\src\contracts\FraxlendPairCore.sol::265 => for (uint256 i = 0; i < _approvedBorrowers.length; ++i) {
2022-08-frax\src\contracts\FraxlendPairCore.sol::270 => for (uint256 i = 0; i < _approvedLenders.length; ++i) {
2022-08-frax\src\contracts\FraxlendPairDeployer.sol::402 => for (uint256 i = 0; i < _lengthOfArray; ) {
2022-08-frax\src\contracts\FraxlendWhitelist.sol::51 => for (uint256 i = 0; i < _addresses.length; i++) {
2022-08-frax\src\contracts\FraxlendWhitelist.sol::66 => for (uint256 i = 0; i < _addresses.length; i++) {
2022-08-frax\src\contracts\FraxlendWhitelist.sol::81 => for (uint256 i = 0; i < _addresses.length; i++) {

Cache Array Length Outside of Loop

2022-08-frax\src\contracts\FraxlendPair.sol::80 => // solhint-disable-next-line max-line-length
2022-08-frax\src\contracts\FraxlendPair.sol::289 => for (uint256 i = 0; i < _lenders.length; i++) {
2022-08-frax\src\contracts\FraxlendPair.sol::308 => for (uint256 i = 0; i < _borrowers.length; i++) {
2022-08-frax\src\contracts\FraxlendPairCore.sol::254 => if (bytes(_name).length == 0) {
2022-08-frax\src\contracts\FraxlendPairCore.sol::257 => if (bytes(nameOfContract).length != 0) {
2022-08-frax\src\contracts\FraxlendPairCore.sol::265 => for (uint256 i = 0; i < _approvedBorrowers.length; ++i) {
2022-08-frax\src\contracts\FraxlendPairCore.sol::270 => for (uint256 i = 0; i < _approvedLenders.length; ++i) {
2022-08-frax\src\contracts\FraxlendPairCore.sol::1089 => if (_path[_path.length - 1] != address(_collateralContract)) {
2022-08-frax\src\contracts\FraxlendPairCore.sol::1090 => revert InvalidPath(address(_collateralContract), _path[_path.length - 1]);
2022-08-frax\src\contracts\FraxlendPairCore.sol::1175 => if (_path[_path.length - 1] != address(_assetContract)) {
2022-08-frax\src\contracts\FraxlendPairCore.sol::1176 => revert InvalidPath(address(_assetContract), _path[_path.length - 1]);
2022-08-frax\src\contracts\FraxlendPairDeployer.sol::114 => /// @notice The ```deployedPairsLength``` function returns the length of the deployedPairsArray
2022-08-frax\src\contracts\FraxlendPairDeployer.sol::115 => /// @return length of array
2022-08-frax\src\contracts\FraxlendPairDeployer.sol::117 => return deployedPairsArray.length;
2022-08-frax\src\contracts\FraxlendPairDeployer.sol::124 => uint256 _lengthOfArray = _deployedPairsArray.length;
2022-08-frax\src\contracts\FraxlendPairDeployer.sol::125 => address[] memory _addresses = new address[](_lengthOfArray);
2022-08-frax\src\contracts\FraxlendPairDeployer.sol::127 => for (i = 0; i < _lengthOfArray; ) {
2022-08-frax\src\contracts\FraxlendPairDeployer.sol::149 => uint256 _lengthOfArray = _addresses.length;
2022-08-frax\src\contracts\FraxlendPairDeployer.sol::151 => _pairCustomStatuses = new PairCustomStatus[](_lengthOfArray);
2022-08-frax\src\contracts\FraxlendPairDeployer.sol::152 => for (i = 0; i < _lengthOfArray; ) {
2022-08-frax\src\contracts\FraxlendPairDeployer.sol::173 => if (_creationCode.length > 13000) {
2022-08-frax\src\contracts\FraxlendPairDeployer.sol::174 => bytes memory _secondHalf = BytesLib.slice(_creationCode, 13000, _creationCode.length - 13000);
2022-08-frax\src\contracts\FraxlendPairDeployer.sol::324 => (deployedPairsArray.length + 1).toString()
2022-08-frax\src\contracts\FraxlendPairDeployer.sol::379 => _approvedBorrowers.length > 0,
2022-08-frax\src\contracts\FraxlendPairDeployer.sol::380 => _approvedLenders.length > 0
2022-08-frax\src\contracts\FraxlendPairDeployer.sol::401 => uint256 _lengthOfArray = _addresses.length;
2022-08-frax\src\contracts\FraxlendPairDeployer.sol::402 => for (uint256 i = 0; i < _lengthOfArray; ) {
2022-08-frax\src\contracts\FraxlendWhitelist.sol::51 => for (uint256 i = 0; i < _addresses.length; i++) {
2022-08-frax\src\contracts\FraxlendWhitelist.sol::66 => for (uint256 i = 0; i < _addresses.length; i++) {
2022-08-frax\src\contracts\FraxlendWhitelist.sol::81 => for (uint256 i = 0; i < _addresses.length; i++) {

Use != 0 instead of > 0 for Unsigned Integer Comparison

2022-08-frax\src\contracts\FraxlendPairCore.sol::440 => // We know totalBorrow.shares > 0
2022-08-frax\src\contracts\FraxlendPairCore.sol::477 => if (_currentRateInfo.feeToProtocolRate > 0) {
2022-08-frax\src\contracts\FraxlendPairCore.sol::754 => if (_collateralAmount > 0) {
2022-08-frax\src\contracts\FraxlendPairCore.sol::835 => if (userBorrowShares[msg.sender] > 0) {
2022-08-frax\src\contracts\FraxlendPairCore.sol::1002 => if (_leftoverBorrowShares > 0) {
2022-08-frax\src\contracts\FraxlendPairCore.sol::1094 => if (_initialCollateralAmount > 0) {
2022-08-frax\src\contracts\FraxlendPairDeployer.sol::379 => _approvedBorrowers.length > 0,
2022-08-frax\src\contracts\FraxlendPairDeployer.sol::380 => _approvedLenders.length > 0
2022-08-frax\src\contracts\FraxlendPairHelper.sol::235 => if (_feeToProtocolRate > 0) {
2022-08-frax\src\contracts\FraxlendPairHelper.sol::292 => if (_leftoverCollateral <= 0 && (_borrowerShares - _sharesToLiquidate) > 0) {
2022-08-frax\src\contracts\LinearInterestRate.sol::66 => _vertexUtilization < MAX_VERTEX_UTIL && _vertexUtilization > 0,
2022-08-frax\src\contracts\LinearInterestRate.sol::67 => "LinearInterestRate: _vertexUtilization < MAX_VERTEX_UTIL && _vertexUtilization > 0"

Use immutable for OpenZeppelin AccessControl's Roles Declarations

2022-08-frax\src\contracts\FraxlendPairDeployer.sol::204 => bytes32 salt = keccak256(abi.encodePacked(_saltSeed, _configData));
2022-08-frax\src\contracts\FraxlendPairDeployer.sol::329 => keccak256(abi.encodePacked("public")),
2022-08-frax\src\contracts\FraxlendPairDeployer.sol::372 => keccak256(abi.encodePacked(_name)),

Long Revert Strings

2022-08-frax\src\contracts\FraxlendPairDeployer.sol::205 => require(deployedPairsBySalt[salt] == address(0), "FraxlendPairDeployer: Pair already deployed");
2022-08-frax\src\contracts\FraxlendPairDeployer.sol::228 => require(_pairAddress != address(0), "FraxlendPairDeployer: create2 failed");
2022-08-frax\src\contracts\FraxlendPairDeployer.sol::253 => require(deployedPairsByName[_name] == address(0), "FraxlendPairDeployer: Pair name must be unique");
2022-08-frax\src\contracts\FraxlendPairDeployer.sol::365 => require(_maxLTV <= GLOBAL_MAX_LTV, "FraxlendPairDeployer: _maxLTV is too large");
2022-08-frax\src\contracts\FraxlendPairDeployer.sol::368 => "FraxlendPairDeployer: Only whitelisted addresses"
2022-08-frax\src\contracts\LinearInterestRate.sol::59 => "LinearInterestRate: _minInterest < MAX_INT && _minInterest <= _vertexInterest && _minInterest >= MIN_INT"
2022-08-frax\src\contracts\LinearInterestRate.sol::63 => "LinearInterestRate: _maxInterest <= MAX_INT && _vertexInterest <= _maxInterest && _maxInterest > MIN_INT"
2022-08-frax\src\contracts\LinearInterestRate.sol::67 => "LinearInterestRate: _vertexUtilization < MAX_VERTEX_UTIL && _vertexUtilization > 0"
2022-08-frax\src\contracts\VariableInterestRate.sol::47 => return "Variable Time-Weighted Interest Rate";

Unsafe ERC20 Operation(s)

Qa issue.

2022-08-frax\src\contracts\FraxlendPairCore.sol::783 => /// @dev msg.sender must call ERC20.approve() on the Collateral Token contract prior to invocation
2022-08-frax\src\contracts\FraxlendPairCore.sol::849 => /// @dev The payer must have called ERC20.approve() on the Asset Token contract prior to invocation
2022-08-frax\src\contracts\FraxlendPairCore.sol::878 => /// @dev Caller must first invoke ```ERC20.approve()``` for the Asset Token contract
2022-08-frax\src\contracts\FraxlendPairCore.sol::1055 => /// @dev Caller must invoke ```ERC20.approve()``` on the Collateral Token contract prior to calling function
2022-08-frax\src\contracts\FraxlendPairCore.sol::1103 => _assetContract.approve(_swapperAddress, _borrowAmount);
2022-08-frax\src\contracts\FraxlendPairCore.sol::1184 => _collateralContract.approve(_swapperAddress, _collateralToSwap);

Use Prefix Increment instead of Postfix Increment if possible

2022-08-frax\src\contracts\FraxlendPair.sol::289 => for (uint256 i = 0; i < _lenders.length; i++) {
2022-08-frax\src\contracts\FraxlendPair.sol::308 => for (uint256 i = 0; i < _borrowers.length; i++) {