Cally contest - z3s's results

Low Critical

[L01] Define MAX_FEE:

Use MAX_FEE to ensure users that protocol won't use 100% exercise fee.

Recommended Mitigation Steps:

Define preferable MAX_FEE in contract:

uint256 public constant MAX_FEE = (10 / 100) * 1e18; // 10%

and use it in setFee():

function setFee(uint256 feeRate_) external onlyOwner {
    require(feeRate_ <= MAX_FEE, "Fee too big");
    feeRate = feeRate_;
}

Non Critical

[N01] durationDays is uint8 so it supports days up to 255:

If a user wants more duration than 255 days, she can't set it.

Recommended Mitigation Steps:

Use bigger uint for durationDays.

[N02] Typos in comments:

Change OVVERIDES to OVERRIDES:

Cally.sol
  426,9:         OVVERIDES FUNCTIONS

Gas Optimizations

[G01] uint256 default value is 0 so we can remove = 0:

Cally.sol
  94,28:     uint256 public feeRate = 0;
  95,42:     uint256 public protocolUnclaimedFees = 0;
  282,21:         uint256 fee = 0;

[G02] Use Custom Errors to save Gas:

Custom errors from Solidity 0.8.4 are cheaper than require messages. https://blog.soliditylang.org/2021/04/21/custom-errors/