FEI and TRIBE Redemption contest - lukris02's results

QA Report for FEI and TRIBE Redemption contest

Overview

During the audit, 2 low and 5 non-critical issues were found.

Low Risk Findings (2)

L-1. Misleading comments

Instances

• SimpleFeiDaiPSM.sol

Recommendation

Put comments before functions, not after.

L-2. Functions return input

Instances

Link:

    /// @notice calculate the amount of FEI out for a given `amountIn` of underlying
    function getMintAmountOut(uint256 amountIn) external pure returns (uint256) {
        return amountIn;
    }


    /// @notice calculate the amount of underlying out for a given `amountFeiIn` of FEI
    function getRedeemAmountOut(uint256 amountIn) external pure returns (uint256) {
        return amountIn;
    }

Non-Critical Risk Findings (5)

NC-1. Constants at the end of the contract

Instances

• SimpleFeiDaiPSM.sol

Recommendation

Inside each contract, library or interface, use the following order:

• Type declarations
• State variables
• Events
• Modifiers
• Functions

NC-2. Constants may be used

Description

Constants may be used instead of literal values.

Instances

• return (cTokenExchangeRates[cToken] * amount) / 1e18; (for 1e18)
• require(_cTokens.length == 27, "Must provide exactly 27 exchange rates."); (for 27)
• _exchangeRates[i] > 1e10, (for 1e10)
• require(_cTokens.length == 27, "Must provide exactly 27 merkle roots"); (for 27)

Recommendation

Define constant variables, especially, for repeated values.

NC-3. Missing NatSpec

Description

NatSpec is missing in 1 contract.

Instances

• RariMerkleRedeemer.sol

Recommendation

Add NatSpec for all functions.

NC-4. Floating pragma

Description

Contracts should be deployed with the same compiler version. It helps to ensure that contracts do not accidentally get deployed using, for example, an outdated compiler version that might introduce bugs that affect the contract system negatively.

Instances

• TribeRedeemer.sol
• SimpleFeiDaiPSM.sol

Recommendation

According to SWC-103, pragma version should be locked.

NC-5. Incorrect comment

Description

Not only public but also external.

Instances

/** ---------- Public State-Changing Funcs ----------------- **/