Golom contest - Soosh's results

Low severity findings

GolomToken totalSupply can be slightly above the 1 billion cap

• In the documentation (https://docs.golom.io/tokenomics-and-airdrop), the Golom Token should have a maximum supply of 1Billion Golom Tokens.
• The actual maximum supply will be slightly above this number due to the addFee() emissions. The last emission can result in totalSupply >= 1_000_000_000

if (rewardToken.totalSupply() > 1000000000 * 10**18) {
	return;
}

• The emissions rate depends on the number of stakers and totalSupply at the time so no definite number can be given.

Example: Say that totalSupply() is at 999_900_000 and total staked is 200_000_000.

uint256 tokenToEmit = (dailyEmission * (rewardToken.totalSupply() - rewardToken.balanceOf(address(ve)))) / rewardToken.totalSupply();

tokensToEmit = (600,000 * (999,900,000 - 200,000,000)) / 999,900,000 tokensToEmit = 479988 totalSupply = 999,900,000 + 4799878 totalSupply = 1,000,379,988

Recommendations:

• Additonal logic can be explicitly added (additonal gas costs for each time addFee() is called)
• Or, accept that Max supply can be slightly over 1 billion

Link:

• https://github.com/code-423n4/2022-07-golom/blob/e5efa8f9d6dda92a90b8b2c4902320acf0c26816/contracts/rewards/RewardDistributor.sol#L100

QA Findings

GolomToken symbol differs from documentation

• The symbol for GolomToken in the docs (https://docs.golom.io/tokenomics-and-airdrop) is $GOLOM but the GolomToken in contracts has the symbol $GOL

Link:

• https://github.com/code-423n4/2022-07-golom/blob/e5efa8f9d6dda92a90b8b2c4902320acf0c26816/contracts/governance/GolomToken.sol#L28

VoteEscrow tokens have different name and symbol from documentation

• name and symbol of VoteEscrowCore.sol is 'veNFT'. The documentation (https://docs.golom.io/rewards) suggests it should be called 'veGOLOM'.

Link:

• https://github.com/code-423n4/2022-07-golom/blob/e5efa8f9d6dda92a90b8b2c4902320acf0c26816/contracts/vote-escrow/VoteEscrowCore.sol#L317

Time values can be more readable

• Instead of

uint256 internal constant MAXTIME = 4 * 365 * 86400;
int128 internal constant iMAXTIME = 4 * 365 * 86400;
uint256 constant secsInDay = 24 * 60 * 60;

• It can be more readable

uint256 internal constant MAXTIME = 4 years;
int128 internal constant iMAXTIME = 4 years;
uint256 constant secsInDay = 1 days;

Links:

• https://github.com/code-423n4/2022-07-golom/blob/e5efa8f9d6dda92a90b8b2c4902320acf0c26816/contracts/vote-escrow/VoteEscrowCore.sol#L296
• https://github.com/code-423n4/2022-07-golom/blob/e5efa8f9d6dda92a90b8b2c4902320acf0c26816/contracts/rewards/RewardDistributor.sol#L57

Recommend using enums for orderType and order status for better code readability

For example, instead of

require(status == 3);

It can be cleaner

require(status == VALID);

Recommended enums:

enum OrderStatus {
	INVALID,
	EXPIRED,
	FILLED_OR_CANCELLED,
	VALID
}

enum OrderType {
	ASK,
	BID,
	CRITERIA_BID
}

Link:

• OrderStatus: https://github.com/code-423n4/2022-07-golom/blob/e5efa8f9d6dda92a90b8b2c4902320acf0c26816/contracts/core/GolomTrader.sol#L158
• OrderType: https://github.com/code-423n4/2022-07-golom/blob/e5efa8f9d6dda92a90b8b2c4902320acf0c26816/contracts/core/GolomTrader.sol#L51

Unneeded if check

The signaturesigner != o.signer if check is not needed as if it were true, the transaction would have already reverted from the above require(signaturesigner == o.signer, 'invalid signature') check.

require(signaturesigner == o.signer, 'invalid signature');
if (signaturesigner != o.signer) {
	return (0, hashStruct, 0);
}

Link:

• https://github.com/code-423n4/2022-07-golom/blob/e5efa8f9d6dda92a90b8b2c4902320acf0c26816/contracts/core/GolomTrader.sol#L178