hats-finance/HATs-Arbitration-Contracts-0x79a618f675857b45934ca1c413fd5f409cf89735

Issues

• Missing checks for address(0x0) when updating address state variables

  #77 opened a year ago
  1

• Missing checks for address(0x0) in the constructor/initializer

  #76 opened a year ago
  0

• Code does not follow the best practice of check-effects-interaction

  #75 opened a year ago
  0

• approve()/safeApprove() may revert if the current approval is not zero

  #74 opened a year ago
  0

• Consider implementing two-step procedure for updating protocol addresses

  #73 opened a year ago
  1

• External calls in an un-bounded for-loop may result in a DOS

  #72 opened a year ago
  0

• Use Ownable2Step rather than Ownable

  #71 opened a year ago
  1

• safeApprove() is deprecated

  #70 opened a year ago
  1

• Array lengths not checked

  #69 opened a year ago
  0

• approve() does note remove old entries before adding new ones

  #68 opened a year ago
  0

• PaymentSplitter.sol and consequently PaymentSplitterUpgradeable.sol has been removed by Openzeppelin

  #67 opened a year ago
  7

• Contracts will have no owner after deployment

  #63 opened a year ago
  1

• logClaim fee logic can be improved

  #62 opened a year ago
  1

• Initialize function should use initialize modifier

  #61 opened a year ago
  1

• Arrays are pushed not popped

  #60 opened a year ago
  1

• Deprecated safeApprove() function

  #59 opened a year ago
  1

• Vaults will not remain undestroyable after EIP-4758 implementation

  #58 opened a year ago
  1

• Vaults will not remain undestroyable after EIP-4758 #2

  #57 opened a year ago
  1

• createHATPaymentSplitter function doesn't check for duplicate addresses, zero addresses, and length of both parameter arrays

  #56 opened a year ago
  1

• test title

  #55 opened a year ago
  1

• After a `TokenLock` is revoked tokens can be lost permanently

  #54 opened a year ago
  0

• `cloneDeterministic` can cause DOS

  #53 opened a year ago
  4

• wrapping of timestamp in uint32

  #52 opened a year ago
  3

• submitClaimRequests is deleted in approveSubmitClaimRequest function before submitClaim is called and submitClaim can revert

  #51 opened a year ago
  1

• No validation on _descriptionHash. Could approve a claim with malformed data

  #50 opened a year ago
  1

• Resolution cannot completely cancel the payment of a bounty

  #49 opened a year ago
  2

• `HATPaymentSplitterFactory.predictSplitterAddress` can predict invalid splitter addresses, which can lead to user loss of funds

  #48 opened a year ago
  0

• Anyone can submit a reference to an Evidence on the HATKlerosConnector

  #47 opened a year ago
  2

• HATArbitrator does not validate if vault is present in HATVaultsRegistry

  #46 opened a year ago
  1

• `HATArbitrator.dispute()`can be called after dispute has been resolved

  #45 opened a year ago
  2

• A malicious beneficiary can destroy the TokenLock contract unexpectedly with inflating the contracts balance

  #44 opened a year ago
  3

• addRewardController and setVaultDescription functions will not be callable because of the wrongly written `onlyRegistryOwner` modifier

  #43 opened a year ago
  9

• Functions such as makePayout, setWithdrawPaused, startVault, destroyVault having the `onlyClaimsManager` modifier will always revert because of the wrongly written `onlyClaimsManager` modifier

  #42 opened a year ago
  11

• The `_descriptionHash` parameter passed into the setVaultDescription function cannot be set

  #41 opened a year ago
  1

• in HATToken, setMinter Function doesn't consider the _cap

  #40 opened a year ago
  4

• Disputers and expert committee should not receive or be refunded bonds after dismissed resolution

  #39 opened a year ago
  5

• Depositors can withdraw deposits after an inconclusive arbitration process over bounty amount

  #38 opened a year ago
  1

• Disputers can recover bonds lost in dispute by stealing bonds of future claims

  #37 opened a year ago
  2

• Anyone can drain `HATArbitrator` via `refundExpiredSubmitClaimRequest()` with non-existing claims

  #36 opened a year ago
  0

• Missing storage gap for upgradeable contracts

  #35 opened a year ago
  1

• Incorrect Authorization Check in `submitClaim` function

  #34 opened a year ago
  4

• Ownership can be Renounced

  #33 opened a year ago
  6

• Protection to initializer is not provided

  #32 opened a year ago
  6

• Use upgradeable instead of contract variants of OpenZeppelin

  #31 opened a year ago
  4

• `HATVaultsRegistry.swapAndSend()` can be sandwiched when swapping `_asset` tokens for exact HAT tokens

  #30 opened a year ago
  1

• onlyResolvedDispute modifier is redundant in dismissResolution

  #29 opened a year ago
  1

• Use Ownable2StepUpgradeable instead of OwnableUpgradeable for access control

  #28 opened a year ago
  1

• Anyone can call the `executeResolution` funtion when a resolution is not challenged and challenge period passed

  #27 opened a year ago
  1

• In `HATVaultsRegistry.sol`, `_routingContract` code existence is not checked while using low level function

  #26 opened a year ago
  3

• In `HATKlerosV2Connector.sol`, call() should be used instead of transfer() in `notifyArbitrator()`

  #25 opened a year ago
  3