Wenwin contest - erictee's results

[L-01] Avoid floating pragmas for non-library contracts.

Impact

While floating pragmas make sense for libraries to allow them to be included with multiple different versions of applications, it may be a security risk for application implementations.

A known vulnerable compiler version may accidentally be selected or security tools might fall-back to an older compiler version ending up checking a different EVM compilation that is ultimately deployed on the blockchain.

It is recommended to pin to a concrete compiler version.

Findings:

./VRFv2RNSource.sol:L3     pragma solidity ^0.8.7;

./staking/StakedTokenLock.sol:L3     pragma solidity ^0.8.17;

./interfaces/IVRFv2RNSource.sol:L3     pragma solidity ^0.8.7;

[L-02] _safemint() should be used rather than _mint() wherever possible

Impact

_mint() is discouraged in favor of _safeMint() which ensures that the recipient is either an EOA or implements IERC721Receiver. Both OpenZeppelin and solmate have versions of this function

Findings:

./Ticket.sol:L26        _mint(to, ticketId);

[N-01] require() should be used instead of assert()

Impact

Prior to solidity version 0.8.0, hitting an assert consumes the remainder of the transaction’s available gas rather than returning it, as require()/revert() do. assert() should be avoided even past solidity version 0.8.0 as its documentation states that “The assert function creates an error of type Panic(uint256). … Properly functioning code should never create a Panic, not even on invalid external input. If this happens, then there is a bug in your contract which you should fix”.

Findings:

./LotterySetup.sol:L147        assert(initialPot > 0);

./TicketUtils.sol:L99            assert((winTier <= selectionSize) && (intersection == uint256(0)));

[N-02] Incomplete Natspec

Findings:

1. File: src/Lottery.sol (lines 178-186)

     /// @dev Registers the ticket in the system. To be called when user is buying the ticket.
    /// @param drawId Draw identifier ticket is bought for.
    /// @param ticket Combination packed as uint120.
    function registerTicket(
        uint128 drawId,
        uint120 ticket,
        address frontend,
        address referrer
    )

Missing @param frontend & @param referrer.

[N-03] Unused functions

Findings:

1. File: src/staking/Staking.sol (lines 108-116)

The function _beforeTokenTransfer is not used anywhere in the contract and should be removed.

    function _beforeTokenTransfer(address from, address to, uint256) internal override {
        if (from != address(0)) {
            _updateReward(from);
        }

        if (to != address(0)) {
            _updateReward(to);
        }
    }