Frankencoin - ayden's results

1.Use a more recent version of solidity instead of ^0.8.0

2.Import declarations should import specific symbols Prefer import declarations that specify the symbol(s) using the form import {SYMBOL} from "SomeContract.sol" rather than importing the whole file.

3.require() / revert() statements should have descriptive reason strings https://github.com/code-423n4/2023-04-frankencoin/blob/main/contracts/MintingHub.sol#L171#L172

4.the function name isPosition may be a bit misleading because function names that start with 'is' typically indicate a boolean return value that represents whether a certain state is true or not. In this case, the function name may mislead people into thinking that it returns a boolean value. It is suggested to change the function name to a more descriptive name, such as getPositionMinter() https://github.com/code-423n4/2023-04-frankencoin/blob/main/contracts/Frankencoin.sol#L300

function getPositionMinter(address _position) override public view returns (address){
    return positions[_position];
}

5.The "Withdraw" function's target address parameter is missing a zero address check,if the target address is accidentally set to 0 address, the token will be lost forever https://github.com/code-423n4/2023-04-frankencoin/blob/main/contracts/Position.sol#L249#L255

6.For important operations like withdrawals, it's better to include an event to record the action https://github.com/code-423n4/2023-04-frankencoin/blob/main/contracts/Position.sol#L249#L255

function withdraw(address token, address target, uint256 amount) external onlyOwner {
    if (token == address(collateral)){
        withdrawCollateral(target, amount);
    } else {
        IERC20(token).transfer(target, amount);
    }

    + emit WithDrawEvent(token,targer,amount);
}

7.lack of a zero address check. https://github.com/code-423n4/2023-04-frankencoin/blob/main/contracts/MintingHub.sol#L54#L57 https://github.com/code-423n4/2023-04-frankencoin/blob/main/contracts/StablecoinBridge.sol#L26#L31 https://github.com/code-423n4/2023-04-frankencoin/blob/main/contracts/Frankencoin.sol#L83#L90

8.The mintInternal function does not check whether the target address is a valid address or not. This could result in the minted tokens being sent to a non-existent address, which would cause them to be permanently lost https://github.com/code-423n4/2023-04-frankencoin/blob/main/contracts/StablecoinBridge.sol#L49#L54

9.Before burning, it is necessary to check whether the user's balance is sufficient. https://github.com/code-423n4/2023-04-frankencoin/blob/main/contracts/StablecoinBridge.sol#L68

function burnInternal(address zchfHolder, address target, uint256 amount) internal {
  + require(zchf.balanceOf(msg.sender)>=amount,"Insufficient funds");
    zchf.burn(zchfHolder, amount);
    chf.transfer(target, amount);
}