Skip to content

Latest commit

 

History

History
710 lines (454 loc) · 30.1 KB

v2.4.0-slither-report.md

File metadata and controls

710 lines (454 loc) · 30.1 KB

THIS CHECKLIST IS NOT COMPLETE. Use --show-ignored-findings to show all the results. Summary

shadowing-state

Forgot to set this but only one module modifies the variable

Impact: High Confidence: High

contracts/modules/internal/ERC20SnapshotModuleInternal.sol#L25

reentrancy-no-eth

Impact: Medium Confidence: Medium

contracts/modules/CMTAT_BASE.sol#L189-L192

uninitialized-local

The concerned variable local mostRecent is initialized in the loop

Impact: Medium Confidence: Medium

contracts/modules/internal/base/SnapshotModuleBase.sol#L389

missing-zero-check

Mock: not intended to be used in production

Impact: Low Confidence: Medium

contracts/mocks/AuthorizationEngineMock.sol#L21

calls-loop

Mock: not intended to be used in production ValidationModuleInternal: the loop happens only for batch function. A relevant alternative could be the creation of a batch function for the RuleEngine, but for the moment we don't have an implemented solution.

Impact: Low Confidence: Medium

contracts/mocks/RuleEngine/RuleEngineMock.sol#L83-L97

contracts/mocks/RuleEngine/RuleEngineMock.sol#L83-L97

contracts/modules/internal/ValidationModuleInternal.sol#L64-L66

contracts/mocks/RuleEngine/RuleEngineMock.sol#L39-L59

reentrancy-benign

Factory contract : It is not a security issue since only authorized user can call the function CMTAT_BASE._update: the contract called is a trusted contract (RuleEngine)

Impact: Low Confidence: Medium

contracts/deployment/CMTAT_BEACON_FACTORY.sol#L41-L75

contracts/deployment/CMTAT_TP_FACTORY.sol#L32-L68

contracts/modules/CMTAT_BASE.sol#L198-L213

reentrancy-events

It is not a security issue since only authorized user can call the function

Impact: Low Confidence: Medium

contracts/deployment/CMTAT_TP_FACTORY.sol#L32-L68

contracts/deployment/CMTAT_BEACON_FACTORY.sol#L41-L75

timestamp

With the Proof of Work, it was possible for a miner to modify the timestamp in a range of about 15 seconds

With the Proof Of Stake, a new block is created every 12 seconds

In all cases, we are not looking for such precision

Impact: Low Confidence: Medium

contracts/modules/internal/base/SnapshotModuleBase.sol#L149-L177

contracts/modules/internal/base/SnapshotModuleBase.sol#L182-L223

contracts/modules/internal/base/SnapshotModuleBase.sol#L250-L263

contracts/modules/internal/base/SnapshotModuleBase.sol#L118-L144

contracts/modules/internal/base/SnapshotModuleBase.sol#L228-L242

contracts/modules/internal/base/SnapshotModuleBase.sol#L375-L402

costly-loop

Inside the function, these two operations are not performed inside a loop.

It seems that the only loops which callssetCurrentSnapshotare inside the batch functions(mintBatch, burnBatch, ...) through a call to the function update. At the moment, there is no trivial solution to resolve this.

Impact: Informational Confidence: Medium

contracts/modules/internal/base/SnapshotModuleBase.sol#L321-L330

contracts/modules/internal/base/SnapshotModuleBase.sol#L321-L330

dead-code

  • Implemented to be gasless compatible (see MetaTxModule)

  • If we remove this function, we will have the following error:

    "Derived contract must override function "_msgData". Two or more base classes define function with same name and parameter types."

Impact: Informational Confidence: Medium

contracts/modules/CMTAT_BASE.sol#L240-L247

solc-version

The version set in the config file is 0.8.22

Impact: Informational Confidence: High

  • ID-23 Version constraint ^0.8.20 contains known severe issues (https://solidity.readthedocs.io/en/latest/bugs.html)
    • VerbatimInvalidDeduplication
    • FullInlinerNonExpressionSplitArgumentEvaluationOrder
    • MissingSideEffectsOnSelectorAccess. It is used by:
    • node_modules/@openzeppelin/contracts/access/AccessControl.sol#4
    • node_modules/@openzeppelin/contracts/access/IAccessControl.sol#4
    • node_modules/@openzeppelin/contracts/access/Ownable.sol#4
    • node_modules/@openzeppelin/contracts/interfaces/IERC1967.sol#4
    • node_modules/@openzeppelin/contracts/interfaces/IERC5267.sol#4
    • node_modules/@openzeppelin/contracts/interfaces/draft-IERC6093.sol#3
    • node_modules/@openzeppelin/contracts/proxy/ERC1967/ERC1967Proxy.sol#4
    • node_modules/@openzeppelin/contracts/proxy/ERC1967/ERC1967Utils.sol#4
    • node_modules/@openzeppelin/contracts/proxy/Proxy.sol#4
    • node_modules/@openzeppelin/contracts/proxy/beacon/BeaconProxy.sol#4
    • node_modules/@openzeppelin/contracts/proxy/beacon/IBeacon.sol#4
    • node_modules/@openzeppelin/contracts/proxy/beacon/UpgradeableBeacon.sol#4
    • node_modules/@openzeppelin/contracts/proxy/transparent/ProxyAdmin.sol#4
    • node_modules/@openzeppelin/contracts/proxy/transparent/TransparentUpgradeableProxy.sol#4
    • node_modules/@openzeppelin/contracts/token/ERC20/IERC20.sol#4
    • node_modules/@openzeppelin/contracts/token/ERC20/extensions/IERC20Metadata.sol#4
    • node_modules/@openzeppelin/contracts/utils/Address.sol#4
    • node_modules/@openzeppelin/contracts/utils/Arrays.sol#4
    • node_modules/@openzeppelin/contracts/utils/Context.sol#4
    • node_modules/@openzeppelin/contracts/utils/StorageSlot.sol#5
    • node_modules/@openzeppelin/contracts/utils/Strings.sol#4
    • node_modules/@openzeppelin/contracts/utils/cryptography/ECDSA.sol#4
    • node_modules/@openzeppelin/contracts/utils/cryptography/MessageHashUtils.sol#4
    • node_modules/@openzeppelin/contracts/utils/introspection/ERC165.sol#4
    • node_modules/@openzeppelin/contracts/utils/introspection/IERC165.sol#4
    • node_modules/@openzeppelin/contracts/utils/math/Math.sol#4
    • node_modules/@openzeppelin/contracts/utils/math/SignedMath.sol#4
    • contracts/CMTAT_PROXY.sol#3
    • contracts/CMTAT_STANDALONE.sol#3
    • contracts/deployment/CMTAT_BEACON_FACTORY.sol#2
    • contracts/deployment/CMTAT_TP_FACTORY.sol#2
    • contracts/interfaces/ICCIPToken.sol#3
    • contracts/interfaces/ICMTATSnapshot.sol#3
    • contracts/interfaces/IDebtGlobal.sol#3
    • contracts/interfaces/draft-IERC1404/draft-IERC1404.sol#3
    • contracts/interfaces/draft-IERC1404/draft-IERC1404EnumCode.sol#3
    • contracts/interfaces/draft-IERC1404/draft-IERC1404Wrapper.sol#3
    • contracts/interfaces/engine/IAuthorizationEngine.sol#3
    • contracts/interfaces/engine/IRuleEngine.sol#3
    • contracts/libraries/Errors.sol#3
    • contracts/mocks/AuthorizationEngineMock.sol#3
    • contracts/mocks/MinimalForwarderMock.sol#3
    • contracts/mocks/RuleEngine/CodeList.sol#3
    • contracts/mocks/RuleEngine/RuleEngineMock.sol#3
    • contracts/mocks/RuleEngine/RuleMock.sol#3
    • contracts/mocks/RuleEngine/interfaces/IRule.sol#3
    • contracts/mocks/RuleEngine/interfaces/IRuleEngineMock.sol#3
    • contracts/modules/CMTAT_BASE.sol#3
    • contracts/modules/internal/ERC20SnapshotModuleInternal.sol#3
    • contracts/modules/internal/EnforcementModuleInternal.sol#3
    • contracts/modules/internal/ValidationModuleInternal.sol#3
    • contracts/modules/internal/base/SnapshotModuleBase.sol#3
    • contracts/modules/security/AuthorizationModule.sol#3
    • contracts/modules/wrapper/controllers/ValidationModule.sol#3
    • contracts/modules/wrapper/core/BaseModule.sol#3
    • contracts/modules/wrapper/core/ERC20BaseModule.sol#3
    • contracts/modules/wrapper/core/ERC20BurnModule.sol#3
    • contracts/modules/wrapper/core/ERC20MintModule.sol#3
    • contracts/modules/wrapper/core/EnforcementModule.sol#3
    • contracts/modules/wrapper/core/PauseModule.sol#3
    • contracts/modules/wrapper/extensions/DebtModule/CreditEventsModule.sol#3
    • contracts/modules/wrapper/extensions/DebtModule/DebtBaseModule.sol#3
    • contracts/modules/wrapper/extensions/ERC20SnapshotModule.sol#3
    • contracts/modules/wrapper/extensions/MetaTxModule.sol#3
    • contracts/test/proxy/CMTAT_PROXY.sol#3
    • openzeppelin-contracts-upgradeable/contracts/access/AccessControlUpgradeable.sol#4
    • openzeppelin-contracts-upgradeable/contracts/metatx/ERC2771ContextUpgradeable.sol#4
    • openzeppelin-contracts-upgradeable/contracts/metatx/ERC2771ForwarderUpgradeable.sol#4
    • openzeppelin-contracts-upgradeable/contracts/proxy/utils/Initializable.sol#4
    • openzeppelin-contracts-upgradeable/contracts/token/ERC20/ERC20Upgradeable.sol#4
    • openzeppelin-contracts-upgradeable/contracts/utils/ContextUpgradeable.sol#4
    • openzeppelin-contracts-upgradeable/contracts/utils/NoncesUpgradeable.sol#3
    • openzeppelin-contracts-upgradeable/contracts/utils/PausableUpgradeable.sol#4
    • openzeppelin-contracts-upgradeable/contracts/utils/cryptography/EIP712Upgradeable.sol#4
    • openzeppelin-contracts-upgradeable/contracts/utils/introspection/ERC165Upgradeable.sol#4

naming-convention

It is not really necessary to rename all the variables. It will generate a lot of work for a minor improvement.

Impact: Informational Confidence: High

contracts/interfaces/draft-IERC1404/draft-IERC1404EnumCode.sol#L9-L14

contracts/modules/wrapper/extensions/DebtModule/CreditEventsModule.sol#L83

contracts/mocks/RuleEngine/RuleEngineMock.sol#L42

contracts/CMTAT_PROXY.sol#L7-L21

contracts/modules/wrapper/core/PauseModule.sol#L26-L28

contracts/modules/wrapper/extensions/DebtModule/CreditEventsModule.sol#L28-L30

contracts/modules/CMTAT_BASE.sol#L249

contracts/modules/internal/EnforcementModuleInternal.sol#L40-L42

contracts/modules/internal/ValidationModuleInternal.sol#L68

contracts/modules/wrapper/core/ERC20BurnModule.sol#L19-L21

contracts/modules/internal/ValidationModuleInternal.sol#L24-L31

contracts/modules/wrapper/core/BaseModule.sol#L94

contracts/modules/wrapper/controllers/ValidationModule.sol#L136

contracts/modules/wrapper/core/EnforcementModule.sol#L55

contracts/CMTAT_STANDALONE.sol#L7-L53

contracts/modules/wrapper/extensions/DebtModule/DebtBaseModule.sol#L232

contracts/modules/security/AuthorizationModule.sol#L85

contracts/mocks/RuleEngine/RuleEngineMock.sol#L74

contracts/mocks/RuleEngine/RuleEngineMock.sol#L64

contracts/mocks/RuleEngine/RuleEngineMock.sol#L73

contracts/mocks/RuleEngine/RuleMock.sol#L14

contracts/mocks/RuleEngine/RuleEngineMock.sol#L75

contracts/modules/internal/EnforcementModuleInternal.sol#L87

contracts/mocks/RuleEngine/RuleMock.sol#L35

contracts/modules/internal/base/SnapshotModuleBase.sol#L404

contracts/mocks/RuleEngine/RuleEngineMock.sol#L63

contracts/modules/wrapper/core/BaseModule.sol#L40-L50

contracts/modules/security/AuthorizationModule.sol#L22-L33

contracts/mocks/RuleEngine/RuleEngineMock.sol#L62

contracts/mocks/RuleEngine/RuleMock.sol#L15

contracts/modules/wrapper/core/PauseModule.sol#L83

contracts/modules/CMTAT_BASE.sol#L148-L150

contracts/modules/wrapper/extensions/ERC20SnapshotModule.sol#L77

contracts/mocks/RuleEngine/RuleMock.sol#L26

contracts/modules/wrapper/core/ERC20BaseModule.sol#L28-L32

contracts/mocks/RuleEngine/RuleMock.sol#L41

contracts/modules/CMTAT_BASE.sol#L87-L146

contracts/modules/wrapper/core/ERC20MintModule.sol#L17-L19

contracts/mocks/RuleEngine/RuleEngineMock.sol#L41

contracts/modules/wrapper/extensions/MetaTxModule.sol#L22

contracts/modules/internal/base/SnapshotModuleBase.sol#L64-L67

contracts/modules/wrapper/core/ERC20BurnModule.sol#L113

contracts/modules/wrapper/core/ERC20BaseModule.sol#L113

contracts/deployment/CMTAT_BEACON_FACTORY.sol#L15-L93

contracts/modules/CMTAT_BASE.sol#L29-L250

contracts/mocks/RuleEngine/RuleEngineMock.sol#L84

contracts/modules/wrapper/core/ERC20MintModule.sol#L73

contracts/modules/wrapper/controllers/ValidationModule.sol#L26-L28

contracts/modules/wrapper/extensions/DebtModule/DebtBaseModule.sol#L60-L62

contracts/mocks/RuleEngine/RuleEngineMock.sol#L40

contracts/modules/wrapper/extensions/ERC20SnapshotModule.sol#L20-L22

contracts/modules/internal/ERC20SnapshotModuleInternal.sol#L140

contracts/modules/wrapper/core/EnforcementModule.sol#L25-L27

contracts/modules/internal/ERC20SnapshotModuleInternal.sol#L27-L30

contracts/deployment/CMTAT_TP_FACTORY.sol#L11-L78

contracts/mocks/RuleEngine/RuleMock.sol#L13

contracts/CMTAT_PROXY.sol#L20