Sublime contest - hake's results

LOW

Low#1: Functions lacking zero address checks in PoolCreditLine.sol LenderPool.sol

PoolCreditLine.constructor LenderPool.constructor LenderPool.create

Recommend implementing zero address check.

Low#2: PooledCreditLine.getPrincipal should be declared to external

PooledCreditLine.getPrincipal

Low#3: Start fee in LenderPool.start might not be received

IERC20(_borrowAsset).transfer(_to, _fee);

The unsafe transfer function doesnt check the boolean return value to see if the fee has been received, leading to _fee not being delivered.

LenderPool.start

Recommend implementing a check.

NON-CRITICAL

Non-crit#1: Outdated compiler version

pragma solidity 0.7.6;

It's a best practice to use the latest compiler version.

Older compilers might be susceptible to some bugs. Recommend changing the solidity version pragma to the latest version to enforce the use of an up to date compiler.

List of known compiler bugs and their severity can be found here: https://etherscan.io/solcbuginfo

Non-crit#2: uint gas efficiency

uint256 is more gas efficient than uint128.

PooledCreditLine.sol

Non-crit#3: _updateProtocolFeeFraction added layer of security

_updateProtocolFeeFraction

Recommend setting a limit to protocolFeeFraction as an extra layer of security in case onlyOwner gets compromised.

Example:

function _updateProtocolFeeFraction(uint256 _protocolFeeFraction) internal {
        require(_protocolFeeFraction <= SCALING_FACTOR, 'IUPFF1');
        require(_protocolFeeFraction < ARBITRARY_NUMBER, 'IUPFF2');
        protocolFeeFraction = _protocolFeeFraction;
        emit ProtocolFeeFractionUpdated(_protocolFeeFraction);
    }

Gas : Global var updates code structure is unnecessarily big

updateGlobalVar

Instead of:

function updatePriceOracle(address _priceOracle) external onlyOwner {
        require(priceOracle != _priceOracle, 'UPO1');
        _updatePriceOracle(_priceOracle);
    }

    function _updatePriceOracle(address _priceOracle) internal {
        require(_priceOracle != address(0), 'IUPO1');

        priceOracle = _priceOracle;
        emit PriceOracleUpdated(_priceOracle);
    }

It could be:

function updatePriceOracle(address _priceOracle) external onlyOwner {
        require(priceOracle != _priceOracle, 'UPO1');
        require(_priceOracle != address(0), 'UPO2');
        priceOracle = _priceOracle;
        emit PriceOracleUpdated(_priceOracle);

    }

It was not specified how the contract size was fixed in the next release, so this might or might not apply.