Rigor Protocol contest - mics's results

Table Of Content

• QA REPORT
  • Should approve(0) first
  • Different solidity versions are in use
  • Contract should have pause/unpause functionality
  • Missing zero address check for initializers functions
  • validate fee parameter
  • Missing an event after critical initialize() functions
  • Some of the following function specification is missing
  • Several functions are declaring named returns but then are using return statements. I suggest choosing only one for readability reasons.
  • Events not emitted for important state changes
  • Add event to the following functions
  • Consider removing the unused parameters names in the following functions

QA REPORT

Should approve(0) first

Some tokens (like USDT L199) do not work when changing the allowance from an existing non-zero allowance value. They must first be approved by zero and then the actual allowance must be approved.

Code Instances:

• Project.sol#L448
• Project.sol#L473

Different solidity versions are in use

The project is compiled with different versions of solidity, which is not recommended because it can lead to undefined behaviors.

Contract should have pause/unpause functionality

In case a hack is occuring or an exploit is discovered, the team (or validators in this case) should be able to pause functionality until the necessary changes are made to the system. Additionally, the gravity.sol contract should be manged by proxy so that upgrades can be made by the validators. Because an attack would probably span a number of blocks, a method for pausing the contract would be able to interrupt any such attack if discovered.)

Code Instances:

• Project.sol
• DebtToken.sol
• HomeFiProxy.sol

Missing zero address check for initializers functions

Missing checks for zero-addresses may lead to infunctional protocol. In this case the function is an initializer then the value can be passed only once and is important to be validated. If the variable addresses are updated incorrectly.

Code Instances:

• Disputes.sol#L79
• HomeFi.sol#L107
• Community.sol#L107
• ProjectFactory.sol#L51
• Project.sol#L98

validate fee parameter

The fee parameter should be validated to be strictly greater than 0 and less than 100%. In the following lines at least one of those checks is missing.

Code Instances:

• HomeFi.sol#L189
• HomeFi.sol#L107

Missing an event after critical initialize() functions

To record the initialize parameters for off-chain monitoring and transparency reasons, you might find it useful to emit an event after the initialize() functions

Code Instances:

• Disputes.sol#L79
• Community.sol#L107
• HomeFiProxy.sol#L61
• ProjectFactory.sol#L51
• Project.sol#L88

Some of the following function specification is missing

Code Instances:

• Disputes.sol#L79
• Community.sol#L501
• HomeFiProxy.sol#L103
• Community.sol#L726
• Community.sol#L714

Several functions are declaring named returns but then are using return statements. I suggest choosing only one for readability reasons.

Using both named returns and a return statement isn't necessary. Removing one of those can improve code clarity.

Code Instances:

• Project.sol#L721
• Community.sol#L904
• HomeFi.sol#L308

Events not emitted for important state changes

When changing state variables events are not emitted. Emitting events allows monitoring activities with off-chain monitoring tools.

Code Instances:

• Community.sol#L107
• ProjectFactory.sol#L62
• Project.sol#L834
• Disputes.sol#L79
• ProjectFactory.sol#L51

Add event to the following functions

Code Instances:

• HomeFi.sol#L107
• Community.sol#L107
• HomeFi.sol#L269
• HomeFiProxy.sol#L61
• Project.sol#L98

Consider removing the unused parameters names in the following functions

For instance, Community.sol#L291

Table Of Content

• GAS REPORT
  • replace <= and >=
  • Don't cache msg.sender
  • Use custom errors
  • Use assembly opcodes iszero instead of solidity equation to save gas
  • If the function is onlyOwner you may make it payable to reduce gas usage.

GAS REPORT

Don't cache msg.sender

reading msg.sender is 2 gas units which is less than a read of a local var + the unnecessary store operation.

Code Instances:

• Disputes.sol#L101
• HomeFi.sol#L148
• Project.sol#L800
• Community.sol#L578
• Community.sol#L567

Use custom errors

In the following require statements you can use custom errors to save gas and improve code quality.

Code Instances:

• Community.sol#L247
• ProjectFactory.sol#L83
• Community.sol#L240
• Project.sol#L194
• Community.sol#L250

Use assembly opcodes iszero instead of solidity equation to save gas

Code Instances:

• Community.sol#L271
• Project.sol#L512

If the function is onlyOwner you may make it payable to reduce gas usage.

Code Instances:

• Community.sol#L291
• Community.sol#L566
• HomeFi.sol#L140
• DebtToken.sol#L74
• Community.sol#L304