Rigor Protocol contest - bobirichman's results

• [LOW] Use mult before div
• [LOW] The project is compiled with different solidity versions
• [LOW] Missing nonReentrancy modifier
• [LOW] Add timelock for the following functions
• [LOW] Not verified input
• [LOW] In the following functions consider verifying the fee parameter
• [NON CRITICAL] Missing function spec comments
• [NON CRITICAL] NonReentrancy should be the first modifier in order
• [NON CRITICAL] Consider emitting an event at the following functions
• [NON CRITICAL] Unused function parameters should have name removed

QA REPORT

[LOW] Use mult before div

To improve the following calculations precision consider changing the order of the operations such that multiplications come before divisions. Example: Project.sol#L905

[LOW] The project is compiled with different solidity versions

[LOW] Missing nonReentrancy modifier

The following functions allows attackers to try reentrancy since they are calling to external contracts / transferring eth. Consider adding a nonReentrancy modifier.

Proof of concept:

• Project.sol#L98
• Community.sol#L126
• Community.sol#L211

[LOW] Add timelock for the following functions

Using a timelock in the following type of functions is common among defi protocols.

Proof of concept:

• HomeFi.sol#L140
• Project.sol#L333
• HomeFi.sol#L205

[LOW] Not verified input

At the following functions you should verify the parameters that are being assigned to a state variable.

Proof of concept:

• HomeFi.sol#L205
• Project.sol#L98
• HomeFi.sol#L177

[LOW] In the following functions consider verifying the fee parameter

Where the fee parameter validation is checking greater than 0% (which may happen by mistake) and less than 100%

Proof of concept:

• HomeFi.sol#L189
• HomeFi.sol#L107

[NON CRITICAL] Missing function spec comments

Proof of concept:

• Community.sol#L304
• Project.sol#L319
• Community.sol#L173

[NON CRITICAL] NonReentrancy should be the first modifier in order

Example: Disputes.sol#L145

[NON CRITICAL] Consider emitting an event at the following functions

Proof of concept:

• HomeFi.sol#L107
• Project.sol#L834
• ProjectFactory.sol#L51

[NON CRITICAL] Unused function parameters should have name removed

If for any reason the following unused parameters are necessary then remove their naming (since only the type matters for function signature) Example: Community.sol#L291

Table Of Content

• [GAS] Cache array size
• [GAS] Do not cache msg.sender since loading msg.sender is more efficient than a local variable
• [GAS] Use > instead != to compare uint with 0
• [GAS] In the following revert statements consider using custom error instead a message
• [GAS] Use assembly opcodes iszero in the following locations
• [GAS] Mark as payable If has onlyOwner modifier

GAS REPORT

[GAS] Cache array size

You can cache the array size to improve gas usage in the following locations Example: Project.sol#L602

[GAS] Do not cache msg.sender since loading msg.sender is more efficient than a local variable

Proof of concept:

• Community.sol#L403
• Project.sol#L326
• Community.sol#L533

[GAS] Use > instead != to compare uint with 0

Proof of concept:

• Community.sol#L763
• Project.sol#L194

[GAS] In the following revert statements consider using custom error instead a message

Proof of concept:

• Community.sol#L383
• Community.sol#L240
• Project.sol#L152

[GAS] Use assembly opcodes iszero in the following locations

Proof of concept:

• Project.sol#L512
• Community.sol#L271

[GAS] Mark as payable If has onlyOwner modifier

In order to save gas you can put a payable modifier for functions that are called by protocol owners.

Proof of concept:

• Community.sol#L466
• HomeFiProxy.sol#L154
• Disputes.sol#L88