Notional contest - SolidityScan's results

Handle

SolidityScan

Vulnerability details

Description

The value of totalSupply() at https://github.com/code-423n4/2022-01-notional/blob/main/contracts/sNOTE.sol#L260 does not check if the value of totalSupply is 0 or not and it is per

Impact

The return value for the function getPoolTokenShare can be invalid because if there's an error in the totalSupply() the code at Line 260 will evaluate to divide by zero creating inconsistencies in the function logic.

Proof of Concept

1. Check the function at https://github.com/code-423n4/2022-01-notional/blob/main/contracts/sNOTE.sol#L257-L261
2. At line 260 we will notice that the value of totalSupply() is directly being used to perform division to the multiplication of bptBalance * sNOTEAmount

Recommended Mitigation Steps

Add a check if the value of totalSupply() is zero or not or some other edge cases that can cause inconsistencies.

Handle

SolidityScan

Vulnerability details

Description

Multiple variables were found to be declared but never used throughout the smart contract code. Having unused variables declared and unused cost unnecessary gas.

Impact

Smart Contracts are required to have effective Gas usage as they cost real money. Therefore each and every function and variable declaration should be monitored for ways to save Gas to make the code Gas efficient.

PoC

The below variables were defined but never used and hence can be removed. https://github.com/code-423n4/2022-01-notional/blob/main/contracts/global/StorageLayoutV1.sol#16 liquidationEnabledState

https://github.com/code-423n4/2022-01-notional/blob/main/contracts/global/StorageLayoutV1.sol#18 hasInitialized

https://github.com/code-423n4/2022-01-notional/blob/main/contracts/global/StorageLayoutV1.sol#28 rollbackRouterImplementation

https://github.com/code-423n4/2022-01-notional/blob/main/contracts/global/StorageLayoutV1.sol#33 nTokenWhitelist

https://github.com/code-423n4/2022-01-notional/blob/main/contracts/global/StorageLayoutV1.sol#36 nTokenAllowance

https://github.com/code-423n4/2022-01-notional/blob/main/contracts/global/StorageLayoutV1.sol#40 globalTransferOperator

https://github.com/code-423n4/2022-01-notional/blob/main/contracts/global/StorageLayoutV1.sol#43 accountAuthorizedTransferOperator

https://github.com/code-423n4/2022-01-notional/blob/main/contracts/global/StorageLayoutV1.sol#46 authorizedCallbackContract

https://github.com/code-423n4/2022-01-notional/blob/main/contracts/global/StorageLayoutV1.sol#50 tokenAddressToCurrencyId

https://github.com/code-423n4/2022-01-notional/blob/main/contracts/global/StorageLayoutV2.sol#L15
pendingOwner

https://github.com/code-423n4/2022-01-notional/blob/main/contracts/global/LibStorage.sol#L14 NUM_NTOKEN_MARKET_FACTORS

https://github.com/code-423n4/2022-01-notional/blob/main/contracts/global/LibStorage.sol#L17 MAX_PORTFOLIO_ASSETS

https://github.com/code-423n4/2022-01-notional/blob/main/contracts/utils/EIP1271Wallet.sol#L20 ETH_PRECISION

https://github.com/code-423n4/2022-01-notional/blob/main/contracts/TreasuryManager.sol#L35 refundGasPrice

Recommended Mitigation Steps

Do not initialize and declare the variables that have no use. Delete them if they are not meant to be used anywhere.