LUKSO - banpaleo5's results

Provides creators and users with future-proof tools and standards to unleash their creative force in an open interoperable ecosystem.

General Information

Platform: Code4rena

Start Date: 30/06/2023

Pot Size: $100,000 USDC

Total HM: 8

Participants: 22

Period: 14 days

Judge: Trust

Total Solo HM: 6

Id: 253

League: ETH

LUKSO

Findings Distribution

Researcher Performance

Rank: 16/22

Findings: 1

Award: $60.20

QA:
grade-b

🌟 Selected for report: 0

🚀 Solo Findings: 0

Findings Information

🌟 Selected for report: gpersoon

Also found by: DavidGiladi, MiloTruck, Rolezn, banpaleo5, catellatech, matrix_0wl, naman1778, vnavascues

Labels

bug
grade-b
QA (Quality Assurance)
Q-03

Awards

60.1995 USDC - $60.20

External Links

Table of Contents

NumberIssues DetailsCount
[L-1]Incorporating Value Comparison in Set Functions1
[L-2]Utilize _safeMint for Safer Minting15
[L-3]Add Contract-Existence Check to safeTransfer Function3
[L-4]Validate Address Parameters to Avoid Issues1
[N-1]Circumvent Usage of Overlapping Variable Names1
[N-2]Update OpenZeppelin Contract Dependency to Latest Version1
[N-3]Implement Two-Step TransferOwnership1
[N-4]Omitting Initialization of uint Variables to Zero3
[N-5]Changing Visibility of Uninvoked Functions to External1

[L-1]</a><a name="L-1"> Incorporating Value Comparison in Set Functions

To enhance the functionality of set functions, it is recommended to incorporate a comparison mechanism to verify that the current value and the new value are distinct.

<details> <summary><i>There are 1 instances of this issue:</i></summary>
File: LSP6Utils.sol
function setDataViaKeyManager(
        address keyManagerAddress,
        bytes32[] memory keys,
        bytes[] memory values
    ) internal returns (bytes memory result) {
        bytes memory payload = abi.encodeWithSelector(
            IERC725Y.setDataBatch.selector,
            keys,
            values
        );
        result = ILSP6KeyManager(keyManagerAddress).execute(payload);
    }
</details>

[L-2]</a><a name="L-2"> Utilize _safeMint for Safer Minting

To enhance the safety and security of the minting process in your contract, it is recommended to use the _safeMint function instead of _mint. The _safeMint function incorporates additional checks and safeguards to mitigate potential risks.

<details> <summary><i>There are 15 instances of this issue:</i></summary>
File: LSP7CompatibleERC20Mintable.sol
_mint(to, amount, allowNonLSP1Recipient, data);
File: LSP8CappedSupplyInitAbstract.sol
super._mint(to, tokenId, allowNonLSP1Recipient, data);
File: LSP7CappedSupplyInitAbstract.sol
super._mint(to, amount, allowNonLSP1Recipient, data);
File: LSP7MintableInitAbstract.sol
_mint(to, amount, allowNonLSP1Recipient, data);
File: LSP8CompatibleERC721MintableInitAbstract.sol
_mint(to, tokenId, allowNonLSP1Recipient, data);
File: LSP7CompatibleERC20InitAbstract.sol
super._mint(to, amount, allowNonLSP1Recipient, data);
File: LSP8CappedSupply.sol
super._mint(to, tokenId, allowNonLSP1Recipient, data);
File: LSP7CompatibleERC20.sol
super._mint(to, amount, allowNonLSP1Recipient, data);
File: LSP8Mintable.sol
_mint(to, tokenId, allowNonLSP1Recipient, data);
File: LSP8CompatibleERC721InitAbstract.sol
super._mint(to, tokenId, allowNonLSP1Recipient, data);
File: LSP8CompatibleERC721Mintable.sol
_mint(to, tokenId, allowNonLSP1Recipient, data);
File: LSP7CappedSupply.sol
super._mint(to, amount, allowNonLSP1Recipient, data);
File: LSP7CompatibleERC20MintableInitAbstract.sol
_mint(to, amount, allowNonLSP1Recipient, data);
File: LSP8MintableInitAbstract.sol
_mint(to, tokenId, allowNonLSP1Recipient, data);
File: LSP7Mintable.sol
_mint(to, amount, allowNonLSP1Recipient, data);
</details>

[L-3]</a><a name="L-3"> Add Contract-Existence Check to safeTransfer Function

<details> <summary><i>There are 3 instances of this issue:</i></summary>
File: LSP8CompatibleERC721.sol
function safeTransferFrom(
File: LSP8CompatibleERC721.sol
function _safeTransfer(
File: LSP8CompatibleERC721InitAbstract.sol
function safeTransferFrom(
</details>

[L-4]</a><a name="L-4"> Validate Address Parameters to Avoid Issues

To prevent transaction reverts and gas wastage, validate address parameters to ensure they are not set to the zero address (0x0).

<details> <summary><i>There are 1 instances of this issue:</i></summary>
File: LSP7CompatibleERC20.sol
from
File: LSP7CompatibleERC20.sol
to
</details>

[N-1]</a><a name="N-1"> Circumvent Usage of Overlapping Variable Names

Employing global variable designations such as call{value: value } can lead to overshadowing caused by the resemblance in argument names. This can potentially reduce the comprehensibility of the code and degrade its overall readability.

<details> <summary><i>There are 1 instances of this issue:</i></summary>
File: ERC725XCore.sol
(bool success, bytes memory returnData) = target.call{value: value}(
</details>

[N-2]</a><a name="N-2"> Update OpenZeppelin Contract Dependency to Latest Version

<details> <summary><i>There are 1 instances of this issue:</i></summary>
File: package.json
    "@openzeppelin/contracts": "^4.9.2"
File: package.json
    "@openzeppelin/contracts-upgradeable": "^4.9.2"
</details>

[N-3]</a><a name="N-3"> Implement Two-Step TransferOwnership

<details> <summary><i>There are 1 instances of this issue:</i></summary>
File: OwnableUnset.sol
function transferOwnership(address newOwner) public virtual onlyOwner {
</details>

[N-4]</a><a name="N-4"> Omitting Initialization of uint Variables to Zero

Initializing uint variables to zero is unnecessary since their default value is already 0.

<details> <summary><i>There are 3 instances of this issue:</i></summary>
File: LSP6SetDataModule.sol
uint256 inputDataKeysAllowed = 0;
uint256 ii = 0;
File: LSP6Utils.sol
uint256 pointer = 0;
File: LSP6Utils.sol
uint256 pointer = 0;
</details>

[N-5]</a><a name="N-5"> Changing Visibility of Uninvoked Functions to External

In cases where public functions in a contract are not being called by the contract itself, it is advisable to change their visibility from public to external. Contracts have the flexibility to override parent functions and modify their visibility from external to public as needed. By making this adjustment, code clarity and adherence to best practices can be maintained, improving the overall readability and intent of the contract.

<details> <summary><i>There are 1 instances of this issue:</i></summary>
File: ERC725.sol
function supportsInterface(
        bytes4 interfaceId
    ) public view virtual override(ERC725XCore, ERC725YCore) returns (bool) {
</details>

#0 - c4-judge

2023-08-02T11:16:41Z

trust1995 marked the issue as grade-b

AuditHub

A portfolio for auditors, a security profile for protocols, a hub for web3 security.

Built bymalatrax © 2024

Auditors

Browse

Contests

Browse

Get in touch

ContactTwitter