Skip to content

Latest commit

 

History

History
742 lines (467 loc) · 29.6 KB

v2.5.0-slither-report.md

File metadata and controls

742 lines (467 loc) · 29.6 KB

THIS CHECKLIST IS NOT COMPLETE. Use --show-ignored-findings to show all the results. Summary

incorrect-equality

Impact: Medium Confidence: High

contracts/mocks/DocumentEngineMock.sol#L72-L89

contracts/mocks/DocumentEngineMock.sol#L37-L49

uninitialized-local

The concerned variable local mostRecent is initialized in the loop

Impact: Medium Confidence: Medium

contracts/modules/internal/base/SnapshotModuleBase.sol#L385

unused-return

Not the case

Impact: Medium Confidence: Medium

contracts/modules/wrapper/extensions/DocumentModule.sol#L74-L81

shadowing-local

Mock: not intended to be used in production

Impact: Low Confidence: High

contracts/mocks/DebtEngineMock.sol#L7

missing-zero-check

Mock: not intended to be used in production

Impact: Low Confidence: Medium

contracts/mocks/AuthorizationEngineMock.sol#L21

calls-loop

ValidationModuleInternal: Acknowledge

Mock: not intended to be used in production ValidationModuleInternal: the loop happens only for batch function. A relevant alternative could be the creation of a batch function for the RuleEngine, but for the moment we don't have an implemented solution.

Impact: Low Confidence: Medium

contracts/mocks/RuleEngine/RuleEngineMock.sol#L83-L97

contracts/mocks/RuleEngine/RuleEngineMock.sol#L83-L97

contracts/modules/internal/ValidationModuleInternal.sol#L89-L92

contracts/mocks/RuleEngine/RuleEngineMock.sol#L39-L59

timestamp

With the Proof of Work, it was possible for a miner to modify the timestamp in a range of about 15 seconds

With the Proof Of Stake, a new block is created every 12 seconds

In all cases, we are not looking for such precision

Impact: Low Confidence: Medium

contracts/modules/internal/base/SnapshotModuleBase.sol#L370-L398

contracts/mocks/DocumentEngineMock.sol#L37-L49

contracts/modules/internal/base/SnapshotModuleBase.sol#L420-L424

contracts/modules/internal/base/SnapshotModuleBase.sol#L412-L419

contracts/mocks/DocumentEngineMock.sol#L72-L89

assembly

use to implement ERC-7201

Impact: Informational Confidence: High

contracts/modules/security/AuthorizationModule.sol#L114-L118

contracts/modules/internal/EnforcementModuleInternal.sol#L112-L116

contracts/modules/wrapper/core/BaseModule.sol#L110-L114

contracts/modules/internal/ValidationModuleInternal.sol#L96-L100

contracts/modules/internal/base/SnapshotModuleBase.sol#L427-L431

contracts/modules/wrapper/extensions/DocumentModule.sol#L96-L100

contracts/modules/wrapper/core/PauseModule.sol#L104-L108

contracts/modules/wrapper/extensions/DebtModule.sol#L94-L98

contracts/modules/wrapper/core/ERC20BaseModule.sol#L134-L138

costly-loop

Acknowledge

Mocks are not destined to be used in production

Impact: Informational Confidence: Medium

contracts/mocks/DocumentEngineMock.sol#L72-L89

dead-code

  • Implemented to be gasless compatible (see MetaTxModule)

  • If we remove this function, we will have the following error:

    "Derived contract must override function "_msgData". Two or more base classes define function with same name and parameter types."

Impact: Informational Confidence: Medium

contracts/modules/CMTAT_BASE.sol#L232-L239

solc-version

The version set in the config file is 0.8.27

Impact: Informational Confidence: High

  • ID-26 Version constraint ^0.8.20 contains known severe issues (https://solidity.readthedocs.io/en/latest/bugs.html)
    • VerbatimInvalidDeduplication
    • FullInlinerNonExpressionSplitArgumentEvaluationOrder
    • MissingSideEffectsOnSelectorAccess. It is used by:
    • node_modules/@openzeppelin/contracts-upgradeable/access/AccessControlUpgradeable.sol#4
    • node_modules/@openzeppelin/contracts-upgradeable/metatx/ERC2771ContextUpgradeable.sol#4
    • node_modules/@openzeppelin/contracts-upgradeable/metatx/ERC2771ForwarderUpgradeable.sol#4
    • node_modules/@openzeppelin/contracts-upgradeable/proxy/utils/Initializable.sol#4
    • node_modules/@openzeppelin/contracts-upgradeable/proxy/utils/UUPSUpgradeable.sol#4
    • node_modules/@openzeppelin/contracts-upgradeable/token/ERC20/ERC20Upgradeable.sol#4
    • node_modules/@openzeppelin/contracts-upgradeable/utils/ContextUpgradeable.sol#4
    • node_modules/@openzeppelin/contracts-upgradeable/utils/NoncesUpgradeable.sol#3
    • node_modules/@openzeppelin/contracts-upgradeable/utils/PausableUpgradeable.sol#4
    • node_modules/@openzeppelin/contracts-upgradeable/utils/cryptography/EIP712Upgradeable.sol#4
    • node_modules/@openzeppelin/contracts-upgradeable/utils/introspection/ERC165Upgradeable.sol#4
    • node_modules/@openzeppelin/contracts/access/AccessControl.sol#4
    • node_modules/@openzeppelin/contracts/access/IAccessControl.sol#4
    • node_modules/@openzeppelin/contracts/access/Ownable.sol#4
    • node_modules/@openzeppelin/contracts/interfaces/IERC1967.sol#4
    • node_modules/@openzeppelin/contracts/interfaces/IERC5267.sol#4
    • node_modules/@openzeppelin/contracts/interfaces/draft-IERC1822.sol#4
    • node_modules/@openzeppelin/contracts/interfaces/draft-IERC6093.sol#3
    • node_modules/@openzeppelin/contracts/proxy/ERC1967/ERC1967Proxy.sol#4
    • node_modules/@openzeppelin/contracts/proxy/ERC1967/ERC1967Utils.sol#4
    • node_modules/@openzeppelin/contracts/proxy/Proxy.sol#4
    • node_modules/@openzeppelin/contracts/proxy/beacon/BeaconProxy.sol#4
    • node_modules/@openzeppelin/contracts/proxy/beacon/IBeacon.sol#4
    • node_modules/@openzeppelin/contracts/proxy/beacon/UpgradeableBeacon.sol#4
    • node_modules/@openzeppelin/contracts/proxy/transparent/ProxyAdmin.sol#4
    • node_modules/@openzeppelin/contracts/proxy/transparent/TransparentUpgradeableProxy.sol#4
    • node_modules/@openzeppelin/contracts/token/ERC20/IERC20.sol#4
    • node_modules/@openzeppelin/contracts/token/ERC20/extensions/IERC20Metadata.sol#4
    • node_modules/@openzeppelin/contracts/utils/Address.sol#4
    • node_modules/@openzeppelin/contracts/utils/Arrays.sol#4
    • node_modules/@openzeppelin/contracts/utils/Context.sol#4
    • node_modules/@openzeppelin/contracts/utils/Create2.sol#4
    • node_modules/@openzeppelin/contracts/utils/StorageSlot.sol#5
    • node_modules/@openzeppelin/contracts/utils/Strings.sol#4
    • node_modules/@openzeppelin/contracts/utils/cryptography/ECDSA.sol#4
    • node_modules/@openzeppelin/contracts/utils/cryptography/MessageHashUtils.sol#4
    • node_modules/@openzeppelin/contracts/utils/introspection/ERC165.sol#4
    • node_modules/@openzeppelin/contracts/utils/introspection/IERC165.sol#4
    • node_modules/@openzeppelin/contracts/utils/math/Math.sol#4
    • node_modules/@openzeppelin/contracts/utils/math/SignedMath.sol#4
    • contracts/CMTAT_PROXY.sol#3
    • contracts/CMTAT_PROXY_UUPS.sol#3
    • contracts/CMTAT_STANDALONE.sol#3
    • contracts/deployment/CMTAT_BEACON_FACTORY.sol#2
    • contracts/deployment/CMTAT_TP_FACTORY.sol#2
    • contracts/deployment/CMTAT_UUPS_FACTORY.sol#2
    • contracts/deployment/libraries/CMTATFactoryBase.sol#2
    • contracts/deployment/libraries/CMTATFactoryInvariant.sol#2
    • contracts/deployment/libraries/CMTATFactoryRoot.sol#2
    • contracts/interfaces/ICCIPToken.sol#3
    • contracts/interfaces/ICMTATConstructor.sol#7
    • contracts/interfaces/ICMTATSnapshot.sol#3
    • contracts/interfaces/draft-IERC1404/draft-IERC1404.sol#3
    • contracts/interfaces/draft-IERC1404/draft-IERC1404EnumCode.sol#3
    • contracts/interfaces/draft-IERC1404/draft-IERC1404Wrapper.sol#3
    • contracts/interfaces/engine/IAuthorizationEngine.sol#3
    • contracts/interfaces/engine/IDebtEngine.sol#3
    • contracts/interfaces/engine/IDebtGlobal.sol#3
    • contracts/interfaces/engine/IRuleEngine.sol#3
    • contracts/interfaces/engine/draft-IERC1643.sol#3
    • contracts/libraries/Errors.sol#3
    • contracts/libraries/FactoryErrors.sol#3
    • contracts/mocks/AuthorizationEngineMock.sol#3
    • contracts/mocks/DebtEngineMock.sol#3
    • contracts/mocks/DocumentEngineMock.sol#3
    • contracts/mocks/MinimalForwarderMock.sol#3
    • contracts/mocks/RuleEngine/CodeList.sol#3
    • contracts/mocks/RuleEngine/RuleEngineMock.sol#3
    • contracts/mocks/RuleEngine/RuleMock.sol#3
    • contracts/mocks/RuleEngine/interfaces/IRule.sol#3
    • contracts/mocks/RuleEngine/interfaces/IRuleEngineMock.sol#3
    • contracts/modules/CMTAT_BASE.sol#3
    • contracts/modules/internal/ERC20SnapshotModuleInternal.sol#3
    • contracts/modules/internal/EnforcementModuleInternal.sol#3
    • contracts/modules/internal/ValidationModuleInternal.sol#3
    • contracts/modules/internal/base/SnapshotModuleBase.sol#3
    • contracts/modules/security/AuthorizationModule.sol#3
    • contracts/modules/wrapper/controllers/ValidationModule.sol#3
    • contracts/modules/wrapper/core/BaseModule.sol#3
    • contracts/modules/wrapper/core/ERC20BaseModule.sol#3
    • contracts/modules/wrapper/core/ERC20BurnModule.sol#3
    • contracts/modules/wrapper/core/ERC20MintModule.sol#3
    • contracts/modules/wrapper/core/EnforcementModule.sol#3
    • contracts/modules/wrapper/core/PauseModule.sol#3
    • contracts/modules/wrapper/extensions/DebtModule.sol#3
    • contracts/modules/wrapper/extensions/DocumentModule.sol#3
    • contracts/modules/wrapper/extensions/ERC20SnapshotModule.sol#3
    • contracts/modules/wrapper/extensions/MetaTxModule.sol#3
    • contracts/test/proxy/CMTAT_PROXY_TEST.sol#3
    • contracts/test/proxy/CMTAT_PROXY_TEST_UUPS.sol#3

naming-convention

It is not really necessary to rename all the variables. It will generate a lot of work for a minor improvement.

Impact: Informational Confidence: High

contracts/CMTAT_PROXY_UUPS.sol#L10-L53

contracts/interfaces/draft-IERC1404/draft-IERC1404EnumCode.sol#L9-L14

contracts/modules/internal/EnforcementModuleInternal.sol#L41

contracts/deployment/libraries/CMTATFactoryRoot.sol#L48-L50

contracts/mocks/RuleEngine/RuleEngineMock.sol#L42

contracts/modules/wrapper/core/PauseModule.sol#L28

contracts/deployment/CMTAT_UUPS_FACTORY.sol#L15-L92

contracts/CMTAT_PROXY.sol#L10-L22

contracts/modules/wrapper/core/PauseModule.sol#L34-L36

contracts/modules/wrapper/core/BaseModule.sol#L42-L51

contracts/modules/internal/EnforcementModuleInternal.sol#L53-L55

contracts/deployment/libraries/CMTATFactoryInvariant.sol#L13-L18

contracts/modules/wrapper/core/ERC20BurnModule.sol#L32-L34

contracts/modules/internal/ValidationModuleInternal.sol#L30-L38

contracts/modules/internal/ValidationModuleInternal.sol#L24

contracts/CMTAT_STANDALONE.sol#L10-L36

contracts/mocks/RuleEngine/RuleEngineMock.sol#L74

contracts/mocks/RuleEngine/RuleEngineMock.sol#L64

contracts/mocks/RuleEngine/RuleEngineMock.sol#L73

contracts/mocks/RuleEngine/RuleMock.sol#L14

contracts/mocks/RuleEngine/RuleEngineMock.sol#L75

contracts/mocks/RuleEngine/RuleMock.sol#L35

contracts/modules/wrapper/extensions/DebtModule.sol#L41-L50

contracts/mocks/RuleEngine/RuleEngineMock.sol#L63

contracts/modules/wrapper/extensions/DocumentModule.sol#L41-L48

contracts/modules/wrapper/extensions/DocumentModule.sol#L74

contracts/modules/internal/base/SnapshotModuleBase.sol#L45

contracts/modules/security/AuthorizationModule.sol#L30-L41

contracts/modules/CMTAT_BASE.sol#L77-L129

contracts/modules/wrapper/core/ERC20BaseModule.sol#L26

contracts/mocks/RuleEngine/RuleEngineMock.sol#L62

contracts/mocks/RuleEngine/RuleMock.sol#L15

contracts/CMTAT_PROXY_UUPS.sol#L38

contracts/modules/CMTAT_BASE.sol#L61

contracts/modules/CMTAT_BASE.sol#L131-L133

contracts/modules/wrapper/extensions/DocumentModule.sol#L27

contracts/mocks/RuleEngine/RuleMock.sol#L26

contracts/modules/wrapper/core/ERC20BaseModule.sol#L39-L44

contracts/mocks/RuleEngine/RuleMock.sol#L41

contracts/modules/security/AuthorizationModule.sol#L17

contracts/modules/wrapper/core/ERC20MintModule.sol#L27-L29

contracts/mocks/RuleEngine/RuleEngineMock.sol#L41

contracts/modules/wrapper/core/BaseModule.sol#L27

contracts/modules/internal/base/SnapshotModuleBase.sol#L70-L73

contracts/deployment/CMTAT_BEACON_FACTORY.sol#L16-L111

contracts/modules/CMTAT_BASE.sol#L79

contracts/modules/CMTAT_BASE.sol#L29-L240

contracts/mocks/RuleEngine/RuleEngineMock.sol#L84

contracts/modules/wrapper/controllers/ValidationModule.sol#L28-L30

contracts/mocks/RuleEngine/RuleEngineMock.sol#L40

contracts/modules/wrapper/extensions/DebtModule.sol#L20

contracts/modules/wrapper/extensions/ERC20SnapshotModule.sol#L22-L24

contracts/modules/wrapper/core/EnforcementModule.sol#L27-L29

contracts/modules/internal/ERC20SnapshotModuleInternal.sol#L21-L24

contracts/deployment/CMTAT_TP_FACTORY.sol#L14-L92

contracts/mocks/RuleEngine/RuleMock.sol#L13

similar-names

Impact: Informational Confidence: Medium

contracts/mocks/DocumentEngineMock.sol#L8

contracts/deployment/CMTAT_BEACON_FACTORY.sol#L101-L107

contracts/mocks/DebtEngineMock.sol#L15

too-many-digits

Impact: Informational Confidence: Medium

contracts/deployment/CMTAT_BEACON_FACTORY.sol#L98-L109

contracts/deployment/CMTAT_TP_FACTORY.sol#L79-L90