Mimo DeFi contest - sorrynotsorry's results

Different solidity compiler versions used. This leads to potential security flaws between deployed contracts depending on the compiler version chosen for any particular file. It also greatly increases the cost of maintenance as different compiler versions have different semantics and behavior.

In BalancerV2LPOracle.sol, latestRoundData() method is used, but there is no check if the return value indicates stale data.

The require statements in AddressProvider.sol, VaultsCore.sol , ABDKMath64x64.sol don't throw error messages on revert. When transactions revert, the users won't receive error messages indicating the cause of the failure.

transfer method is used inside the codebase. Since transfer method uses 2300 gas stipend which is not adjustable,it may likely to get broken in future in case of hardforks causing gas price changes or when calling a contract's fallback function. Reference Link -1, Reference Link -2

block.timestamp is used on many places at the scoped contracts. Hoewever, this can be manipulated by malicious miners. Reference

Using immutable instead of constant variables will save gas.

Caching .length inside loop functions will save gas, located at: FeeDistributor.sol#L47-69-75 ,GovernorAlpha.sol#L114-128-148

At AdminInceptionVault.sol:108 storage variable is directly used in looping. It can be cached to memory priorly.

Using bytes32 instead of string to save gas whenever possible. String is a dynamic data structure and therefore is more gas consuming then bytes32. Team can use bytes32 instead of string in the following places: BalancerV2LPOracle.sol:17-29 , GUniLPOracle.sol:15-30

Changing the abi.encode function to abi.encodePacked at SuperVault.sol#L130-131-178-179-226-227 can save gas since the abi.encode function pads extra null bytes at the end of the call data, which is unnecessary. Also, in general, abi.encodePackedis more gas-efficient.