Skip to content

Latest commit

 

History

History
864 lines (479 loc) · 30.3 KB

v2.3.0-slither-report.md

File metadata and controls

864 lines (479 loc) · 30.3 KB

Slither report

Summary

suicidal

Impact: High Confidence: High

contracts/modules/wrapper/mandatory/BaseModule.sol#L114-L120

Remark:

The function is protected by an access control.

Only an address with the role (DEFAULT_ADMIN_ROLE) can call this function

calls-loop

Remark:

  • The RuleEngine is a trusted contract deployed by the issuer.

It is not a problem to perform external call to this contract

  • When a ruleEngine is created, the issuer has indeed to keep in mind to limit the number of rules.

Impact: Low Confidence: Medium

contracts/mocks/RuleEngine/RuleEngineMock.sol#L72-L83

contracts/mocks/RuleEngine/RuleEngineMock.sol#L72-L83

contracts/mocks/RuleEngine/RuleEngineMock.sol#L41-L58

timestamp

Remark:

With the Proof of Work, it was possible for a miner to modify the timestamp in a range of about 15 seconds

With the Proof Of Stake, a new block is created every 12 seconds

In all cases, we are not looking for such precision

Impact: Low Confidence: Medium

contracts/modules/internal/SnapshotModuleInternal.sol#L158-L169

contracts/modules/internal/SnapshotModuleInternal.sol#L83-L96

contracts/modules/internal/SnapshotModuleInternal.sol#L177-L188

contracts/modules/internal/SnapshotModuleInternal.sol#L413-L438

contracts/modules/internal/SnapshotModuleInternal.sol#L127-L153

contracts/modules/internal/SnapshotModuleInternal.sol#L101-L122

dead-code

Remark:

function init:

We have theses dead codes because we follow the same architecture and principle as OpenZeppelin,

For example:https://github.com/OpenZeppelin/openzeppelin-contracts- upgradeable/blob/master/contracts/access/AccessControlUpgradeable.

sol#L51

ID-15 - msgData:

  • Implemented to be gasless compatible (see MetaTxModule)

  • If we remove this function, we will have the following error:

    "Derived contract must override function "_msgData". Two or more base classes define function with same name and parameter types."

Impact: Informational Confidence: Medium

contracts/modules/wrapper/optional/ValidationModule.sol#L25-L49

contracts/modules/wrapper/mandatory/EnforcementModule.sol#L25-L42

contracts/modules/wrapper/optional/SnapshotModule.sol#L19-L42

contracts/modules/wrapper/optional/MetaTxModule.sol#L33-L41

contracts/modules/wrapper/mandatory/BurnModule.sol#L12-L31

contracts/modules/CMTAT_BASE.sol#L195-L202

contracts/modules/wrapper/mandatory/ERC20BaseModule.sol#L23-L34

contracts/modules/wrapper/mandatory/MintModule.sol#L12-L31

contracts/modules/wrapper/mandatory/PauseModule.sol#L20-L35

contracts/modules/internal/SnapshotModuleInternal.sol#L65-L72

contracts/modules/security/AuthorizationModule.sol#L25-L36

contracts/modules/internal/ValidationModuleInternal.sol#L28-L33

contracts/modules/wrapper/optional/DebtModule/DebtBaseModule.sol#L59-L74

contracts/modules/internal/EnforcementModuleInternal.sol#L43-L46

contracts/modules/wrapper/mandatory/BaseModule.sol#L35-L55

contracts/modules/wrapper/optional/DebtModule/CreditEventsModule.sol#L23-L38

solc-version

Remark:

Not necessary, the latest solidity version at the time of this release is the version 0.8.20. The comment is good but we think three versions backwards is enough. It is not the best practice to use an outdated version because each version fixes some bugs.

Impact: Informational Confidence: High

  • ID-26 Pragma version^0.8.17 necessitates a version too recent to be trusted. Consider deploying with 0.6.12/0.7.6/0.8.16

contracts/modules/wrapper/mandatory/BaseModule.sol#L3

  • ID-27 Pragma version^0.8.17 necessitates a version too recent to be trusted. Consider deploying with 0.6.12/0.7.6/0.8.16

contracts/modules/CMTAT_BASE.sol#L3

  • ID-28 Pragma version^0.8.17 necessitates a version too recent to be trusted. Consider deploying with 0.6.12/0.7.6/0.8.16

contracts/modules/wrapper/optional/SnapshotModule.sol#L3

  • ID-29 Pragma version^0.8.17 necessitates a version too recent to be trusted. Consider deploying with 0.6.12/0.7.6/0.8.16

contracts/modules/wrapper/mandatory/MintModule.sol#L3

  • ID-30 Pragma version^0.8.17 necessitates a version too recent to be trusted. Consider deploying with 0.6.12/0.7.6/0.8.16

contracts/modules/wrapper/mandatory/PauseModule.sol#L3

  • ID-31 Pragma version^0.8.17 necessitates a version too recent to be trusted. Consider deploying with 0.6.12/0.7.6/0.8.16

contracts/modules/internal/EnforcementModuleInternal.sol#L3

  • ID-32 Pragma version^0.8.17 necessitates a version too recent to be trusted. Consider deploying with 0.6.12/0.7.6/0.8.16

contracts/CMTAT_PROXY.sol#L3

  • ID-33 Pragma version^0.8.17 necessitates a version too recent to be trusted. Consider deploying with 0.6.12/0.7.6/0.8.16

contracts/modules/wrapper/optional/MetaTxModule.sol#L3

  • ID-34 Pragma version^0.8.17 necessitates a version too recent to be trusted. Consider deploying with 0.6.12/0.7.6/0.8.16

contracts/modules/wrapper/optional/DebtModule/CreditEventsModule.sol#L3

  • ID-35 Pragma version^0.8.0 allows old versions

contracts/mocks/RuleEngine/interfaces/IRuleEngine.sol#L3

  • ID-36 Pragma version^0.8.0 allows old versions

contracts/interfaces/IEIP1404/IEIP1404.sol#L3

  • ID-37 Pragma version^0.8.17 necessitates a version too recent to be trusted. Consider deploying with 0.6.12/0.7.6/0.8.16

contracts/mocks/RuleEngine/RuleMock.sol#L3

  • ID-38 Pragma version^0.8.0 allows old versions

contracts/mocks/RuleEngine/interfaces/IRule.sol#L3

  • ID-39 solc-0.8.17 is not recommended for deployment

  • ID-40 Pragma version^0.8.17 necessitates a version too recent to be trusted. Consider deploying with 0.6.12/0.7.6/0.8.16

contracts/modules/wrapper/mandatory/ERC20BaseModule.sol#L3

  • ID-41 Pragma version^0.8.0 allows old versions

contracts/interfaces/IDebtGlobal.sol#L3

  • ID-42 Pragma version^0.8.17 necessitates a version too recent to be trusted. Consider deploying with 0.6.12/0.7.6/0.8.16

contracts/modules/internal/SnapshotModuleInternal.sol#L3

  • ID-43 Pragma version^0.8.17 necessitates a version too recent to be trusted. Consider deploying with 0.6.12/0.7.6/0.8.16

contracts/modules/wrapper/optional/DebtModule/DebtBaseModule.sol#L3

  • ID-44 Pragma version^0.8.17 necessitates a version too recent to be trusted. Consider deploying with 0.6.12/0.7.6/0.8.16

contracts/modules/wrapper/mandatory/EnforcementModule.sol#L3

  • ID-45 Pragma version^0.8.17 necessitates a version too recent to be trusted. Consider deploying with 0.6.12/0.7.6/0.8.16

contracts/modules/security/AuthorizationModule.sol#L3

  • ID-46 Pragma version^0.8.17 necessitates a version too recent to be trusted. Consider deploying with 0.6.12/0.7.6/0.8.16

contracts/modules/internal/ValidationModuleInternal.sol#L3

  • ID-47 Pragma version^0.8.17 necessitates a version too recent to be trusted. Consider deploying with 0.6.12/0.7.6/0.8.16

contracts/modules/wrapper/mandatory/BurnModule.sol#L3

  • ID-48 Pragma version^0.8.0 allows old versions

contracts/interfaces/IEIP1404/IEIP1404Wrapper.sol#L3

  • ID-49 Pragma version^0.8.17 necessitates a version too recent to be trusted. Consider deploying with 0.6.12/0.7.6/0.8.16

contracts/modules/wrapper/optional/ValidationModule.sol#L3

  • ID-50 Pragma version^0.8.17 necessitates a version too recent to be trusted. Consider deploying with 0.6.12/0.7.6/0.8.16

contracts/mocks/RuleEngine/CodeList.sol#L3

  • ID-51 Pragma version^0.8.17 necessitates a version too recent to be trusted. Consider deploying with 0.6.12/0.7.6/0.8.16

contracts/CMTAT_STANDALONE.sol#L3

  • ID-52 Pragma version^0.8.17 necessitates a version too recent to be trusted. Consider deploying with 0.6.12/0.7.6/0.8.16

contracts/mocks/MinimalForwarderMock.sol#L3

  • ID-53 Pragma version^0.8.17 necessitates a version too recent to be trusted. Consider deploying with 0.6.12/0.7.6/0.8.16

contracts/modules/security/OnlyDelegateCallModule.sol#L3

  • ID-54 Pragma version^0.8.17 necessitates a version too recent to be trusted. Consider deploying with 0.6.12/0.7.6/0.8.16

contracts/mocks/RuleEngine/RuleEngineMock.sol#L3

naming-convention

Remark:

It is not really necessary to rename all the variables. It will generate a lot of work for a minor improvement.

Impact: Informational Confidence: High

contracts/mocks/RuleEngine/RuleEngineMock.sol#L15

contracts/modules/wrapper/optional/SnapshotModule.sol#L19-L42

contracts/modules/wrapper/optional/DebtModule/CreditEventsModule.sol#L91

contracts/modules/internal/EnforcementModuleInternal.sol#L43-L46

contracts/modules/wrapper/mandatory/MintModule.sol#L12-L31

contracts/interfaces/IEIP1404/IEIP1404Wrapper.sol#L11-L16

contracts/mocks/RuleEngine/RuleEngineMock.sol#L44

contracts/modules/wrapper/mandatory/BurnModule.sol#L51

contracts/modules/internal/ValidationModuleInternal.sol#L28-L33

contracts/CMTAT_PROXY.sol#L8-L25

contracts/modules/wrapper/mandatory/PauseModule.sol#L37-L39

contracts/modules/wrapper/optional/DebtModule/CreditEventsModule.sol#L40-L42

contracts/modules/CMTAT_BASE.sol#L204

contracts/modules/internal/EnforcementModuleInternal.sol#L48-L50

contracts/modules/internal/ValidationModuleInternal.sol#L75

contracts/modules/wrapper/mandatory/EnforcementModule.sol#L25-L42

contracts/modules/internal/SnapshotModuleInternal.sol#L440

contracts/modules/wrapper/mandatory/BaseModule.sol#L122

contracts/modules/wrapper/optional/ValidationModule.sol#L139

contracts/modules/wrapper/mandatory/MintModule.sol#L51

contracts/modules/wrapper/mandatory/EnforcementModule.sol#L74

contracts/CMTAT_STANDALONE.sol#L8-L50

contracts/modules/wrapper/optional/DebtModule/DebtBaseModule.sol#L261

contracts/modules/security/AuthorizationModule.sol#L61

contracts/mocks/RuleEngine/RuleEngineMock.sol#L63

contracts/mocks/RuleEngine/RuleMock.sol#L15

contracts/modules/wrapper/mandatory/ERC20BaseModule.sol#L36-L40

contracts/modules/internal/EnforcementModuleInternal.sol#L91

contracts/mocks/RuleEngine/RuleMock.sol#L33

contracts/modules/security/AuthorizationModule.sol#L43-L48

contracts/mocks/RuleEngine/RuleEngineMock.sol#L62

contracts/modules/wrapper/mandatory/BaseModule.sol#L57-L67

contracts/modules/wrapper/optional/SnapshotModule.sol#L102

contracts/modules/security/AuthorizationModule.sol#L25-L36

contracts/mocks/RuleEngine/RuleEngineMock.sol#L61

contracts/mocks/RuleEngine/RuleMock.sol#L16

contracts/modules/wrapper/mandatory/PauseModule.sol#L67

contracts/modules/CMTAT_BASE.sol#L128-L131

contracts/modules/wrapper/mandatory/BurnModule.sol#L12-L31

contracts/modules/wrapper/optional/ValidationModule.sol#L25-L49

contracts/mocks/RuleEngine/RuleMock.sol#L27

contracts/modules/wrapper/mandatory/BurnModule.sol#L33-L35

contracts/mocks/RuleEngine/RuleMock.sol#L39

contracts/modules/wrapper/mandatory/BaseModule.sol#L35-L55

contracts/modules/wrapper/mandatory/MintModule.sol#L33-L35

contracts/modules/internal/SnapshotModuleInternal.sol#L74-L77

contracts/modules/CMTAT_BASE.sol#L72-L126

contracts/mocks/RuleEngine/RuleEngineMock.sol#L43

contracts/modules/wrapper/optional/MetaTxModule.sol#L43

contracts/modules/wrapper/mandatory/ERC20BaseModule.sol#L23-L34

contracts/modules/internal/SnapshotModuleInternal.sol#L65-L72

contracts/modules/wrapper/optional/DebtModule/CreditEventsModule.sol#L23-L38

contracts/modules/wrapper/optional/SnapshotModule.sol#L44-L46

contracts/modules/wrapper/mandatory/ERC20BaseModule.sol#L108

contracts/modules/CMTAT_BASE.sol#L27-L205

contracts/mocks/RuleEngine/RuleEngineMock.sol#L73

contracts/modules/wrapper/optional/DebtModule/DebtBaseModule.sol#L59-L74

contracts/modules/wrapper/optional/ValidationModule.sol#L51-L53

contracts/modules/wrapper/optional/DebtModule/DebtBaseModule.sol#L76-L78

contracts/mocks/RuleEngine/RuleEngineMock.sol#L42

contracts/modules/wrapper/mandatory/PauseModule.sol#L20-L35

contracts/modules/internal/ValidationModuleInternal.sol#L35-L42

contracts/modules/wrapper/mandatory/EnforcementModule.sol#L44-L46

contracts/mocks/RuleEngine/RuleMock.sol#L14

contracts/CMTAT_PROXY.sol#L24

unused-state

Remark:

You can remove it or you can keep it. It is indeed not a requirement for the main child contract, but it costs nothing to keep it in the code, see https://docs.openzeppelin.com/upgrades-plugins/1.x/writing-upgradeable#storage-gaps

Impact: Informational Confidence: High

contracts/CMTAT_PROXY.sol#L24

constable-states

Remark:

It will not work if we declare the variable as a constant because it is set to :

  • False if deployed in standalone mode (default value)
  • True if deployed with a proxy, set inside the constructor

Impact: Optimization Confidence: High

contracts/modules/wrapper/mandatory/BaseModule.sol#L12

immutable-states

Remark:

It will not work if we declare the variable as an immutable because we set the value inside the constructor of the implementation contract when we perform a deployment with a proxy, which will not be possible if we use an immutable variable.

Impact: Optimization Confidence: High

contracts/modules/wrapper/mandatory/BaseModule.sol#L12