Infinity NFT Marketplace contest - hake's results

QA Report

[L-01] Missing zero address check

https://github.com/code-423n4/2022-06-infinity/blob/765376fa238bbccd8b1e2e12897c91098c7e5ac6/contracts/staking/InfinityStaker.sol#L375 INFINITY_TREASURY what are the implications of setting this to zero?

[L-02] Taker selling might accidentally lose funds

https://github.com/code-423n4/2022-06-infinity/blob/765376fa238bbccd8b1e2e12897c91098c7e5ac6/contracts/core/InfinityExchange.sol#L300

Users selling for a maker buyer might accidentally enter msg.value and lose their ETH.

I suggest adding a check to ensure that it is only possible to have msg.value > 0 if isMakerSeller == true.

[N-01] Public parameters should be written in lower case

https://github.com/code-423n4/2022-06-infinity/blob/765376fa238bbccd8b1e2e12897c91098c7e5ac6/contracts/staking/InfinityStaker.sol#L40-L42

 uint16 public THREE_MONTH_PENALTY = 2;
  uint16 public SIX_MONTH_PENALTY = 3;
  uint16 public TWELVE_MONTH_PENALTY = 4;

[N-02] Wrong error message

https://github.com/code-423n4/2022-06-infinity/blob/765376fa238bbccd8b1e2e12897c91098c7e5ac6/contracts/staking/InfinityStaker.sol#L117-L118

    require(amount != 0, 'stake amount cant be 0');

Error message should be 'unstake amount cant be 0'.

[N-03] Define constant instead of using magic number

https://github.com/code-423n4/2022-06-infinity/blob/765376fa238bbccd8b1e2e12897c91098c7e5ac6/contracts/core/InfinityExchange.sol#L1135

Gas Report

[G-01] Fallback function redundant

There is no need to have both a fallback() and receive() function. You can eliminate one. https://github.com/code-423n4/2022-06-infinity/blob/765376fa238bbccd8b1e2e12897c91098c7e5ac6/contracts/staking/InfinityStaker.sol#L55

[G-02] uint16 is more gas expensive than uint256

https://github.com/code-423n4/2022-06-infinity/blob/765376fa238bbccd8b1e2e12897c91098c7e5ac6/contracts/staking/InfinityStaker.sol#L33-L36

[G-03] Redundant balance check

https://github.com/code-423n4/2022-06-infinity/blob/765376fa238bbccd8b1e2e12897c91098c7e5ac6/contracts/staking/InfinityStaker.sol#L69-L70

    require(IERC20(INFINITY_TOKEN).balanceOf(msg.sender) >= amount, 'insufficient balance to stake');

safeTransferFrom already checks for user balance, so check above is redundant and a waist of gas.

[G-04] Check serves no purpose

https://github.com/code-423n4/2022-06-infinity/blob/765376fa238bbccd8b1e2e12897c91098c7e5ac6/contracts/core/InfinityOrderBookComplication.sol#L73-L77 Check serves no purpose as parameters isOrdersTimeValid and itemsIntersect are set above to true. I suggest removing the parameters and the check.