Mimo August 2022 contest - bobirichman's results

QA REPORT

[LOW] Missing nonReentrancy modifier

The following functions allows attackers to try reentrancy since they are calling to external contracts / transferring eth. Consider adding a nonReentrancy modifier.

Proof of concept:

• MIMOProxyFactory.sol#L45
• MIMOManagedAction.sol#L33
• MIMOLeverage.sol#L44

[LOW] Add timelock for the following functions

Using a timelock in the following type of functions is common among defi protocols.

Proof of concept:

• MIMOAutoAction.sol#L32
• MIMOManagedAction.sol#L55
• MIMOManagedAction.sol#L33

[LOW] Not verified input

At the following functions you should verify the parameters that are being assigned to a state variable.

Proof of concept:

• MIMOProxyFactory.sol#L26
• MIMOManagedRebalance.sol#L33
• MIMOAutoRebalance.sol#L40

[LOW] Payable functions that should not be payable

The following functions are payable but doesn't record the sender transaction. Consider making them not payable instead.

Proof of concept:

• MIMOVaultActions.sol#L54
• MIMOVaultActions.sol#L80

[NON CRITICAL] Floating pragma

Floating pragma is a bad practice, since it does not guaranty the same version at future deployments.

Proof of concept:

• MIMOProxyRegistry.sol
• MIMOProxyFactory.sol

[NON CRITICAL] Missing function spec comments

Proof of concept:

• MIMOEmptyVault.sol#L30
• DexAddressProvider.sol#L51
• MIMOFlashloan.sol#L44

[NON CRITICAL] Consider emitting an event at the following functions

Proof of concept:

• MIMOAutoRebalance.sol#L40
• MIMOLeverage.sol#L30
• MIMOSwap.sol#L26

[NON CRITICAL] Unused function parameters should have name removed

If for any reason the following unused parameters are necessary then remove their naming (since only the type matters for function signature)

Proof of concept:

• MIMOFlashloan.sol#L44
• MIMOLeverage.sol#L30
• MIMORebalance.sol#L30

GAS REPORT

[GAS] Use abiEncodePacked()

Proof of concept:

• MIMOLeverage.sol#L53
• MIMOManagedRebalance.sol#L64
• MIMORebalance.sol#L48

[GAS] Cache array size

You can cache the array size to improve gas usage in the following locations Example: DexAddressProvider.sol#L22

[GAS] Do not cache msg.sender since loading msg.sender is more efficient than a local variable

Proof of concept:

• MIMOLeverage.sol#L117
• MIMOProxyFactory.sol#L46
• MIMOAutoRebalance.sol#L126

[GAS] Use > instead != to compare uint with 0

Example: MIMORebalance.sol#L134

[GAS] In the following revert statements consider using custom error instead a message

Proof of concept:

• DexAddressProvider.sol#L20
• DexAddressProvider.sol#L39
• DexAddressProvider.sol#L40

[GAS] Use assembly opcodes iszero in the following locations

Proof of concept:

• MIMOManagedRebalance.sol#L156
• MIMOManagedAction.sol#L101
• MIMOAutoAction.sol#L82

[GAS] Mark as payable If has onlyOwner modifier

In order to save gas you can put a payable modifier for functions that are called by protocol owners. Example: DexAddressProvider.sol#L39