Mimo August 2022 contest - mics's results

Table Of Content

• QA REPORT
  • Missing 0 address check at transfer
  • Avoid floating pragma
  • SPDX license not provided in source file
  • Contract should have pause/unpause functionality
  • Array access is out of bounds
  • Make sure the following functions has to be payable
  • Usage of pragma experimental ABIEncoder
  • Some of the following function specification is missing
  • Several functions are declaring named returns but then are using return statements. I suggest choosing only one for readability reasons.
  • Events not emitted for important state changes
  • Add event to the following functions
  • Consider removing the unused parameters names in the following functions

QA REPORT

Missing 0 address check at transfer

Some contracts does not support 0 transfer, then the transaction will revert with no explanation. We recommend to add a require statement that the amount is not 0.

Code Instances:

• MIMOEmptyVault.sol#L127
• MIMOVaultActions.sol#L70
• MIMORebalance.sol#L133
• MIMOEmptyVault.sol#L81
• MIMOManagedRebalance.sol#L113

Avoid floating pragma

Contracts should be deployed with the same compiler version and flags that they have been tested with thoroughly. Locking the pragma helps to ensure that contracts do not accidentally get deployed using, for example, an outdated compiler version that might introduce bugs that affect the contract system negatively. (SWC-103)

Code Instances:

• MIMOProxyRegistry.sol
• MIMOProxyFactory.sol

SPDX license not provided in source file

Before publishing, consider adding a comment containing 'SPDX-License-Identifier: MIT' at the beginning of each source file.

Code Instances:

• MIMOEmptyVault.sol
• MIMOAutoRebalance.sol
• MIMOProxyRegistry.sol
• MIMOFlashloan.sol
• MIMOSwap.sol

Contract should have pause/unpause functionality

In case a hack is occuring or an exploit is discovered, the team (or validators in this case) should be able to pause functionality until the necessary changes are made to the system. Additionally, the gravity.sol contract should be manged by proxy so that upgrades can be made by the validators. Because an attack would probably span a number of blocks, a method for pausing the contract would be able to interrupt any such attack if discovered.)

Code Instances:

• MIMOLeverage.sol
• MIMOVaultActions.sol
• MIMOAutoRebalance.sol
• MIMOEmptyVault.sol
• MIMORebalance.sol

Array access is out of bounds

There is no check for the access to be in the array bounds.

Code Instances:

• MIMOManagedRebalance.sol#L97
• MIMOAutoRebalance.sol#L96
• MIMOLeverage.sol#L74
• MIMORebalance.sol#L69
• MIMOEmptyVault.sol#L69

Make sure the following functions has to be payable

I didn't see a use of using payable in the following functions, consider changing it.

Code Instances:

• MIMOVaultActions.sol#L80
• MIMOVaultActions.sol#L54

Usage of pragma experimental ABIEncoder

ABIEncoder is turned on by default from version 8 For instance, DexAddressProvider.sol

Some of the following function specification is missing

Code Instances:

• DexAddressProvider.sol#L39
• MIMOSwap.sol#L26
• MIMOVaultActions.sol#L109
• MIMOLeverage.sol#L30
• MIMOManagedAction.sol#L19

Several functions are declaring named returns but then are using return statements. I suggest choosing only one for readability reasons.

Using both named returns and a return statement isn't necessary. Removing one of those can improve code clarity. For instance, MIMOAutoRebalance.sol#L151

Events not emitted for important state changes

When changing state variables events are not emitted. Emitting events allows monitoring activities with off-chain monitoring tools.

Code Instances:

• MIMOManagedAction.sol#L92
• MIMOManagedRebalance.sol#L33
• MIMOEmptyVault.sol#L30
• MIMOAutoAction.sol#L74
• MIMOProxyRegistry.sol#L26

Add event to the following functions

Code Instances:

• DexAddressProvider.sol#L20
• MIMOManagedAction.sol#L92
• MIMOVaultActions.sol#L32
• MIMOSwap.sol#L26
• MIMOManagedAction.sol#L19

Consider removing the unused parameters names in the following functions

Code Instances:

• MIMOLeverage.sol#L30
• MIMOManagedRebalance.sol#L33
• MIMOEmptyVault.sol#L30
• MIMOFlashloan.sol#L44
• MIMORebalance.sol#L30

Table Of Content

• GAS REPORT
  • Using abiEncodePacked() is more efficient that abiEncode()
  • The following assignments are not in use
  • Don't cache msg.sender
  • Use custom errors
  • Use assembly opcodes iszero instead of solidity equation to save gas
  • If the function is onlyOwner you may make it payable to reduce gas usage.

GAS REPORT

Using abiEncodePacked() is more efficient that abiEncode()

Code Instances:

• MIMORebalance.sol#L48
• MIMOEmptyVault.sol#L48
• MIMOManagedRebalance.sol#L64
• MIMOLeverage.sol#L53
• MIMOAutoRebalance.sol#L72

The following assignments are not in use

Code Instances:

• MIMOManagedRebalance.sol#L112
• MIMOAutoRebalance.sol#L111

Don't cache msg.sender

reading msg.sender is 2 gas units which is less than a read of a local var + the unnecessary store operation.

Code Instances:

• MIMOLeverage.sol#L96
• MIMOManagedRebalance.sol#L109
• MIMORebalance.sol#L31
• MIMOManagedRebalance.sol#L34
• MIMOManagedAction.sol#L104

Use custom errors

In the following require statements you can use custom errors to save gas and improve code quality.

Code Instances:

• DexAddressProvider.sol#L39
• DexAddressProvider.sol#L40
• DexAddressProvider.sol#L20

Use assembly opcodes iszero instead of solidity equation to save gas

Code Instances:

• MIMOManagedAction.sol#L101
• MIMOAutoAction.sol#L82
• MIMOManagedRebalance.sol#L156

If the function is onlyOwner you may make it payable to reduce gas usage.

For instance, DexAddressProvider.sol#L39