Wenwin contest - georgits's results

Remove unused imports

ILotterySetup.sol - 6

IReferralSystem.sol - 5

IRNSourceController.sol - 5

LotteryToken.sol - 7

Lottery.sol - 6

Use the latest solidity version with a stable pragma statement

VRFv2RNSource.sol, IVRFv2RNSource.sol, StakedTokenLock.sol

It is better to use _safeMint over _mint(but add a nonReentrant modifier, since calls to _safeMint can reenter)

Ticket.sol - 26

Missing zero address checks

RNSourceBase.sol - 11

StakedTokenLock.sol - 16

Misleading comment

In RNSourceBase.sol(line 32) it is specified that fulfill() must be called in the deriving contract's requestRandomnessFromUnderlyingSource function but then in VRFv2RNSource(that inherits from RNSourceBase) there is no call to fulfill() in requestRandomnessFromUnderlyingSource(). It is actually used in fulfillRandomWords().

There is no need of if else pattern

LotterySetup.sol - fixedReward()

if (winTier == selectionSize) {
    return _baseJackpot(initialPot);
} else if (winTier == 0 || winTier > selectionSize) {
    return 0;
} else {
   uint256 mask = uint256(type(uint16).max) << (winTier * 16);
   uint256 extracted = (nonJackpotFixedRewards & mask) >> (winTier * 16);
   return extracted * (10 ** (IERC20Metadata(address(rewardToken)).decimals() - 1));
}

Refactored version:

if (winTier == selectionSize) {
    return _baseJackpot(initialPot);
}

if (winTier == 0 || winTier > selectionSize) {
    return 0;
}

uint256 mask = uint256(type(uint16).max) << (winTier * 16);
uint256 extracted = (nonJackpotFixedRewards & mask) >> (winTier * 16);
return extracted * (10 ** (IERC20Metadata(address(rewardToken)).decimals() - 1));

Players should not be able to claim winning tickets until the draw is finalised

requireFinishedDraw() must be called inside claimWinningTicket() to prevent users from claiming winning tickets before the draw is finalised.