Golom contest - cthulhu_cult's results

Lines of code

https://github.com/code-423n4/2022-07-golom/blob/main/contracts/core/GolomTrader.sol#L154

Vulnerability details

• Severity: Medium
• Description: The transfer() and send() functions forward a fixed amount of 2300 gas. The gas cost of EVM instructions may change significantly during hard forks which may break already deployed
• Impact: Deployed contract maybe broken during hardfork.
• Remediation: Avoid the use of transfer() and send() and do not otherwise specify a fixed amount of gas when performing calls. Use .call.value(...)("") instead.
• Count: 1
• Locations: GolomTrader#L154
• Code:

    function payEther(uint256 payAmt, address payAddress) internal {
        if (payAmt > 0) {
            // if royalty has to be paid
            payable(payAddress).transfer(payAmt); // royalty transfer to royaltyaddress
        }
    }

• Tools Used: Visual Studio.

Title: Floating Pragma

• Severity: Low
• Description: Locking the pragma helps to ensure that contracts do not accidentally get deployed using, for example, an outdated compiler version that might introduce bugs that affect the contract system negatively
• Remediation: Lock the pragma version.
• count: 1
• locations: GolemToken.sol#L2
• code:

pragma solidity ^0.8.11;

Title: Precede internal functions with underscore.

• Severity: Quality Assurance
• Description: It's best practice to precede internal function with underscore to distinguish them. From public function which should not have preceding underscore.
• Count: 2...
• Locations: GolomTrader#L154 GolemTrader#L409

Title: Use the IR compiler(--viaIR) pipeline.

• Severity: Quality assurance
• Description: The use of IR compiler pipeline guarantee that certain age cases such as on how state variables are initialized in the inheritance hierarchy see 2022 underhand solidity contest