FactoryDAO contest - delfin454000's results

Typos

https://github.com/code-423n4/2022-05-factorydao/blob/db415804c06143d8af6880bc4cda7222e5463c0e/contracts/VoterID.sol#L117

    /// @dev All permissions around minting should be done thru MerkleIdentity and it's associate gates

Change associate to associated

https://github.com/code-423n4/2022-05-factorydao/blob/db415804c06143d8af6880bc4cda7222e5463c0e/contracts/VoterID.sol#L71

    // owner is a special name in the OpenZeppelin standard that opensea annoyingly expects for their management page

Change opensea to OpenSea

https://github.com/code-423n4/2022-05-factorydao/blob/db415804c06143d8af6880bc4cda7222e5463c0e/contracts/MerkleResistor.sol#L202

        // 3/ token re-enters this function (or other, but this is the only one that transfers tokens out)

Change other to another

Seven instances of the same typo (use of effect when affect is intended) occur in the lines below:

https://github.com/code-423n4/2022-05-factorydao/blob/db415804c06143d8af6880bc4cda7222e5463c0e/contracts/MerkleDropFactory.sol#L76

        // but it does not effect the other trees

https://github.com/code-423n4/2022-05-factorydao/blob/e22a562c01c533b8765229387894cc0cb9bed116/contracts/MerkleVesting.sol#L88

        // but it does not effect the other trees

https://github.com/code-423n4/2022-05-factorydao/blob/db415804c06143d8af6880bc4cda7222e5463c0e/contracts/MerkleVesting.sol#L170

        // but this does not allow re-entrance due to struct updates and it does not effect other trees.

https://github.com/code-423n4/2022-05-factorydao/blob/db415804c06143d8af6880bc4cda7222e5463c0e/contracts/MerkleResistor.sol#L200

        // 1/ token doesn't transfer given amount to recipient, this is bad for user, but does not effect other trees

https://github.com/code-423n4/2022-05-factorydao/blob/db415804c06143d8af6880bc4cda7222e5463c0e/contracts/MerkleResistor.sol#L201

        // 2/ token fails for some reason, again bad for user, but this does not effect other trees

https://github.com/code-423n4/2022-05-factorydao/blob/db415804c06143d8af6880bc4cda7222e5463c0e/contracts/MerkleEligibility.sol#L11

/// @dev Anyone can add a gate, but it doesn't effect anything if it's not connected to a tree in MerkleIdentity

https://github.com/code-423n4/2022-05-factorydao/blob/db415804c06143d8af6880bc4cda7222e5463c0e/contracts/PermissionlessBasicPoolFactory.sol#L82 /// @dev Any malicious token contracts included here will make the pool malicious, but not effect other pools

In each case, change `effect` to `affect`

Issue: Require message is to long Explanation: The messages below can be shortened to 32 characters or fewer (as shown) to save gas

https://github.com/code-423n4/2022-05-factorydao/blob/db415804c06143d8af6880bc4cda7222e5463c0e/contracts/MerkleDropFactory.sol#L90

        require(treeIndex <= numTrees, "Provided merkle index doesn't exist");

Change message to Provided merkle idx nonexistant

https://github.com/code-423n4/2022-05-factorydao/blob/db415804c06143d8af6880bc4cda7222e5463c0e/contracts/MerkleDropFactory.sol#L92

        require(!withdrawn[destination][treeIndex], "You have already withdrawn your entitled token.");

Change message to Token you entitled to already wd

https://github.com/code-423n4/2022-05-factorydao/blob/db415804c06143d8af6880bc4cda7222e5463c0e/contracts/MerkleVesting.sol#L145

        require(block.timestamp > tranche.lockPeriodEndTime, 'Must wait until after lock period');

Change message to Must wait until aft lock period

https://github.com/code-423n4/2022-05-factorydao/blob/db415804c06143d8af6880bc4cda7222e5463c0e/contracts/MerkleResistor.sol#L83

        require(minEndTime < maxEndTime, 'minEndTime must be less than maxEndTime');

Change message to minEndTime must be < maxEndTime

https://github.com/code-423n4/2022-05-factorydao/blob/db415804c06143d8af6880bc4cda7222e5463c0e/contracts/MerkleIdentity.sol#L127

        require(verifyMetadata(tree.metadataMerkleRoot, tokenId, uri, metadataProof), "The metadata proof could not be verified");

Change message to Metadata proof couldn't be ver

https://github.com/code-423n4/2022-05-factorydao/blob/db415804c06143d8af6880bc4cda7222e5463c0e/contracts/VoterID.sol#L98

        require (msg.sender == _owner_, 'Identity: Only owner may call this');

Change message to Identity: Only owner may call

https://github.com/code-423n4/2022-05-factorydao/blob/db415804c06143d8af6880bc4cda7222e5463c0e/contracts/MerkleResistor.sol#L136

        require(msg.sender == destination, 'Can only initialize your own tranche');

Change message to Can only initialize own tranche

https://github.com/code-423n4/2022-05-factorydao/blob/db415804c06143d8af6880bc4cda7222e5463c0e/contracts/VoterID.sol#L239

        require(isApproved(msg.sender, tokenId), 'Identity: Not authorized to approve');

Change message to Identity: Not authorized to app

https://github.com/code-423n4/2022-05-factorydao/blob/db415804c06143d8af6880bc4cda7222e5463c0e/contracts/VoterID.sol#L240

        require(holder != approved, 'Identity: Approving self not allowed');

Change message to Identity: Approving self not ok

https://github.com/code-423n4/2022-05-factorydao/blob/db415804c06143d8af6880bc4cda7222e5463c0e/contracts/VoterID.sol#L305

        require(owners[tokenId] == from, "Identity: Transfer of token that is not own");

Change message to Identity: Tfr of token not own

https://github.com/code-423n4/2022-05-factorydao/blob/db415804c06143d8af6880bc4cda7222e5463c0e/contracts/VoterID.sol#L306

        require(to != address(0), "Identity: transfer to the zero address");

Change message to Identity: tfr to the 0 address

https://github.com/code-423n4/2022-05-factorydao/blob/db415804c06143d8af6880bc4cda7222e5463c0e/contracts/VoterID.sol#L217

        require(checkOnERC721Received(from, to, tokenId, data), "Identity: transfer to non ERC721Receiver implementer");

Not sure how to shorten this message

The same require message occurs in both lines referenced below:

https://github.com/code-423n4/2022-05-factorydao/blob/db415804c06143d8af6880bc4cda7222e5463c0e/contracts/MerkleVesting.sol#L141

https://github.com/code-423n4/2022-05-factorydao/blob/db415804c06143d8af6880bc4cda7222e5463c0e/contracts/MerkleResistor.sol#L171

        require(initialized[destination][treeIndex], "You must initialize your account first.");

Change message to Must initialize your acct first

Issue: Variables should not be initialized to their default values Explanation: Initializing uint variables to their default value of 0 is unnecessary and costs gas

https://github.com/code-423n4/2022-05-factorydao/blob/db415804c06143d8af6880bc4cda7222e5463c0e/contracts/MerkleVesting.sol#L150

        uint currentWithdrawal = 0;

Recommended:

        uint currentWithdrawal;

https://github.com/code-423n4/2022-05-factorydao/blob/db415804c06143d8af6880bc4cda7222e5463c0e/contracts/VoterID.sol#L69

    uint public numIdentities = 0;

Recommended:

    uint public numIdentities;

uint currentWithdrawal is initialized to zero twice, as follows:

https://github.com/code-423n4/2022-05-factorydao/blob/db415804c06143d8af6880bc4cda7222e5463c0e/contracts/MerkleResistor.sol#L176

https://github.com/code-423n4/2022-05-factorydao/blob/db415804c06143d8af6880bc4cda7222e5463c0e/contracts/MerkleVesting.sol#L150

        uint currentWithdrawal = 0;

Recommended:

        uint currentWithdrawal;

uint public numTrees is initialized to zero three times, as follows:

https://github.com/code-423n4/2022-05-factorydao/blob/db415804c06143d8af6880bc4cda7222e5463c0e/contracts/MerkleDropFactory.sol#L17

https://github.com/code-423n4/2022-05-factorydao/blob/db415804c06143d8af6880bc4cda7222e5463c0e/contracts/MerkleVesting.sol#L16

https://github.com/code-423n4/2022-05-factorydao/blob/db415804c06143d8af6880bc4cda7222e5463c0e/contracts/MerkleResistor.sol#L24

    uint public numTrees = 0;

Recommended:

    uint public numTrees;