code-423n4/2021-11-nested-findings

Issues

• mintWithMetadata onlyFactory

  #213 opened 4 years ago by code423n4
  0

• Ensure on-chain that cache is synced

  #217 opened 4 years ago by code423n4
  2

• NestedFactory.removeOperator code doesn't correspond to it's logic

  #220 opened 4 years ago by code423n4
  2

• Passing multiple ETH deposits in orders array will use the same msg.value many times

  #226 opened 4 years ago by code423n4
  2

• Can't revoke factory in NestedRecrods

  #203 opened 4 years ago by code423n4
  0

• Small refactor for functions to save some gas

  #193 opened 4 years ago by code423n4
  0

• Unused local variables

  #195 opened 4 years ago by code423n4
  2

• NestedAsset.setFactory should be named addFactory

  #204 opened 4 years ago by code423n4
  0

• Does not check uniqueness of ShareHolder

  #231 opened 4 years ago by code423n4
  1

• Cant remove the first operator

  #200 opened 4 years ago by code423n4
  2

• no

  #228 opened 4 years ago by code423n4
  1

• nonReentrant modifier causing DOS for releaseTokens

  #229 opened 4 years ago by code423n4
  3

• nonReentrant modifier isn't necessary for releaseToken function

  #187 opened 4 years ago by code423n4
  2

• Restrict funds receivable to be only from wrapped native token

  #188 opened 4 years ago by code423n4
  2

• Tokens can get stuck in _submitOutOrders

  #191 opened 4 years ago by code423n4
  2

• Event needs to be emitted in the Operator module

  #192 opened 4 years ago by code423n4
  2

• Function NestedFactory.destroy doesn't check amounts returned after executing user's market order to sell a portfolio

  #197 opened 4 years ago by code423n4
  2

• NestedReserve.updateFactory function can be used for stealing all contract funds (rug)

  #218 opened 4 years ago by code423n4
  2

• NestedFactory.FeeSplitter can be immediatly changed with current and future fees lost to a malicious Owner

  #219 opened 4 years ago by code423n4
  2

• NestedFactory._decreaseHoldingAmount needs explicit amount control for spending reserve

  #223 opened 4 years ago by code423n4
  2

• Save storage NestedRecords.records.reserve address variable to memory

  #225 opened 4 years ago by code423n4
  2

• Long Revert Strings

  #221 opened 4 years ago by code423n4
  1

• Validations of parameters

  #224 opened 4 years ago by code423n4
  2

• Function NestedFactory._submitOutOrders doesn't check amounts returned from market executing of user's orders

  #196 opened 4 years ago by code423n4
  1

• NestedFactory._calculateFees should be pure to save on call costs

  #201 opened 4 years ago by code423n4
  2

• `_calculateFess` takes user argument as address but unused and can be marked pure

  #233 opened 4 years ago by code423n4
  2

• msg.sender used in ZeroExOperator.sol

  #216 opened 4 years ago by code423n4
  1

• Unused variable "tokens"

  #232 opened 4 years ago by code423n4
  3

• NestedFactory inherits from OpenZeppelin Multicall, which multicall function allows reusage of msg.value within ETH depositing

  #227 opened 4 years ago by code423n4
  2

• change variable location to memory from storage in getAmountsDue (view function)

  #230 opened 4 years ago by code423n4
  2

• NestedFactory.addTokens and withdraw functions require NFT reserve check

  #199 opened 4 years ago by code423n4
  0

• _burnNST

  #208 opened 4 years ago by code423n4
  0

• INestedToken interface

  #206 opened 4 years ago by code423n4
  0

• OperatorResolver.areAddressesImported doesn't check lengths of argument arrays

  #210 opened 4 years ago by code423n4
  0

• Unnecessary Use of _msgSender()

  #185 opened 4 years ago by code423n4
  1

• index + 1 can be simplified

  #207 opened 4 years ago by code423n4
  0

• Check condition before calling NestedFactory._handleUnderSpending

  #198 opened 4 years ago by code423n4
  0

• Unchecked operations

  #214 opened 4 years ago by code423n4
  1

• Division by 0 totalWeights

  #205 opened 4 years ago by code423n4
  1

• Gas Optimization on the Public Functions

  #189 opened 4 years ago by code423n4
  1

• `> 0 can be replaced with != 0 for gas optimisation`

  #190 opened 4 years ago by code423n4
  1

• calculateFees Issues (NestedFactory.sol)

  #194 opened 4 years ago by code423n4
  1

• fillQuote returned value

  #222 opened 4 years ago by code423n4
  1

• Cache array length in for loops can save gas

  #186 opened 4 years ago by code423n4
  1

• Accessing the same storage value multiple times

  #211 opened 4 years ago by code423n4
  1

• setMaxAllowance

  #215 opened 4 years ago by code423n4
  1

• safeTransfer of tokens

  #202 opened 4 years ago by code423n4
  1

• .length in a loop

  #212 opened 4 years ago by code423n4
  1

• Shorter revert messages

  #209 opened 4 years ago by code423n4
  1

• Gas: Unnecessary `balanceOf` call

  #184 opened 4 years ago by code423n4
  1