Juicebox Buyback Delegate - d3e4's results

No check that the Uniswap pool is wETH-projectToken

There is no check that the Uniswap pool set in the constructor actually is for wETH and projectToken. If it isn't it would break swap logic and even allow for a malicious pool or token to be called by this delegate. Consider at least checking that the tokens and pool match.

Use explicit WETH address

WETH is a specific and known contract. There is no reason to have to set it in the constructor. Consider hardcoding it instead:

- IWETH9 public immutable weth;
+ IWETH9 private constant weth = IWETH9(0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2);

Typos

Datasource -> Data source datasource -> data source per definition -> by definition controle -> control toke_beforeTransferTon - > token ? receive -> receives send -> sends burn -> burns mint -> mints burn -> burns sending back the token in in the terminal - > sending back the token in to the terminal

Spell out fc as funding cycle

It may be difficult to know that 'fc' stands for 'funding cycle'. Instances: https://github.com/code-423n4/2023-05-juicebox/blob/9d0458282511ff269b3b35b5b082b56d5cc08663/juice-buyback/contracts/JBXBuybackDelegate.sol#L191 https://github.com/code-423n4/2023-05-juicebox/blob/9d0458282511ff269b3b35b5b082b56d5cc08663/juice-buyback/contracts/JBXBuybackDelegate.sol#L251 https://github.com/code-423n4/2023-05-juicebox/blob/9d0458282511ff269b3b35b5b082b56d5cc08663/juice-buyback/contracts/JBXBuybackDelegate.sol#L337

Barbarismus

"CONTRACTVS" accusativus masculinus pluralis est, itaque "MEAM" sit "MEOS". Aut in singulari "CONTRACTUM MEUM".