Infinity NFT Marketplace contest - samruna's results

QA

1. Unindexed event parameters

Description: Events with more than 2 parameters should have the 'indexed' keyword on their two first parameters, as defined by the ERC20 specification. Failure to include these keywords will exclude the parameter data in the transaction/block's bloom filter, so external tooling searching for these parameters may overlook them and fail to index logs from this token contract.

Code: https://github.com/code-423n4/2022-06-infinity/blob/main/contracts/core/InfinityExchange.sol#L85-95

Mitigation: Add indexed keyword for the first two parameters

2. Events not emitted

Description: Below update functions do not emit events. It is difficult to track off-chain changes in the threshold.

https://github.com/code-423n4/2022-06-infinity/blob/main/contracts/staking/InfinityStaker.sol#L351 https://github.com/code-423n4/2022-06-infinity/blob/main/contracts/staking/InfinityStaker.sol#L364

Mitigation: Emit an event

3. Tautoloy or contradiction Description: require(totalStaked >= 0, 'nothing staked to rage quit'); totalStaked is a uint256, so x>=0 will always be true.

Code: https://github.com/code-423n4/2022-06-infinity/blob/main/contracts/staking/InfinityStaker.sol#L193

Mitigation: Use !=0 instead of > or >=

4. Missing zero address valdation Description: In the below references, the address zero check is not done. This can result in the wrong _matchExecutor or _WETH address

Code: https://github.com/code-423n4/2022-06-infinity/blob/main/contracts/core/InfinityExchange.sol#L104 https://github.com/code-423n4/2022-06-infinity/blob/main/contracts/core/InfinityExchange.sol#L1129 https://github.com/code-423n4/2022-06-infinity/blob/main/contracts/core/InfinityExchange.sol#L1155 https://github.com/code-423n4/2022-06-infinity/blob/main/contracts/staking/InfinityStaker.sol#L49 https://github.com/code-423n4/2022-06-infinity/blob/main/contracts/staking/InfinityStaker.sol#L345 https://github.com/code-423n4/2022-06-infinity/blob/main/contracts/staking/InfinityStaker.sol#L375

Mitigation: Add address zero check

5. Function visibility Description: Public functions that are never called by the contract should be declared as external to save gas

Code: https://github.com/code-423n4/2022-06-infinity/blob/main/contracts/staking/InfinityStaker.sol#L154 https://github.com/code-423n4/2022-06-infinity/blob/main/contracts/staking/InfinityStaker.sol#L167

Mitigation: Declare the functions as external