Olympus DAO contest - bobirichman's results

QA REPORT

[LOW] Approve 0 first

At some tokens you can approve an amount (at USDT for instance) only after approving to 0. Consider using increase/decrease approve notation instead.

Proof of concept:

• BondCallback.t.sol#L476
• Governance.t.sol#L101

[LOW] Use safeApprove

Use safeApprove in the following locations

Proof of concept:

• BondCallback.t.sol#L208
• BondCallback.t.sol#L211

[LOW] Use mult before div

To improve the following calculations precision consider changing the order of the operations such that multiplications come before divisions.

Example: BondCallback.t.sol#L270

[LOW] Missing pause functionality

Proof of concept:

• Deploy.sol
• Governance.sol

[LOW] Consider replacing assert with require

Assertions are a bad practice, use require instead.

Proof of concept:

• BondCallback.t.sol#L476
• BondCallback.t.sol#L483

[LOW] Not verified input

At the following functions you should verify the parameters that are being assigned to a state variable.

Proof of concept:

• Kernel.sol#L235
• MINTR.t.sol#L117

[LOW] Missing nonReentrancy modifier

The following functions allows attackers to try reentrancy since they are calling to external contracts / transferring eth. Consider adding a nonReentrancy modifier.

Proof of concept:

• VOTES.t.sol#L46
• PRICE.t.sol#L382

[NON CRITICAL] Missing function spec comments

Proof of concept:

• PRICE.t.sol#L323
• VOTES.sol#L39

[NON CRITICAL] Consider emitting an event at the following functions

Proof of concept:

• Kernel.sol#L217
• Kernel.t.sol#L38

[NON CRITICAL] The following events are not indexed

Proof of concept:

• Operator.sol#L53
• Heart.sol#L30

[NON CRITICAL] NonReentrancy should be the first modifier in order

Example: Operator.sol#L276

[NON CRITICAL] Floating pragma

Floating pragma is a bad practice, since it does not guaranty the same version at future deployments.

Proof of concept:

• TreasuryCustodian.t.sol
• PriceConfig.t.sol

GAS REPORT

[GAS] Remove casting of latestAnswer()

latestAnswer() naturally returns int and not uint. You can work with signed integers instead to save gas of the casting.

Proof of concept:

• PRICE.t.sol#L81
• PRICE.t.sol#L255

[GAS] Use assembly opcodes iszero in the following locations

Proof of concept:

• Governance.sol#L297
• PRICE.sol#L267

[GAS] Cache array size

You can cache the array size to improve gas usage in the following locations

Example: Governance.sol#L277

[GAS] Use > instead != to compare uint with 0

Proof of concept:

• TRSRY.t.sol#L97
• TRSRY.t.sol#L107

[GAS] Mark as payable If has onlyOwner modifier

In order to save gas you can put a payable modifier for functions that are called by protocol owners.

Proof of concept:

• Governance.sol#L76
• TreasuryCustodian.sol#L75