Report

Audit report for 2023-12-autonolas generated by ubl4nk_bot.

Medium Issues

Total 9 instances over 3 issues:

ID	Issue	Instances
M-1	Non-compliant `IERC20` tokens may revert with `transfer`	2
M-2	Return values of `transfer()`/`transferFrom()` not checked	3
M-3	`transfer`/`transferFrom` may never return `true` for some tokens	4

Low Issues

Total 522 instances over 29 issues:

ID	Issue	Instances
L-1	Missing zero address check in functions with address parameters	85
L-2	Array is `push()`ed but not `pop()`ed	2
L-3	Division by zero not prevented	11
L-4	Consider implementing two-step procedure for updating protocol addresses	22
L-5	Constructor / initialization function lacks parameter validation	9
L-6	Code does not follow the best practice of check-effects-interaction	19
L-7	External call recipient can consume all remaining gas	4
L-8	External function calls within loops	12
L-9	Loss of precision in divisions	13
L-10	Missing checks for state variable assignments	78
L-11	Missing limits when setting min/max amounts	1
L-12	Missing zero address check in constructor	4
L-13	Consider some checks for `address(0)` when setting address state variables	69
L-14	Multiplication on the result of a division	4
L-15	NFT doesn't handle hard forks	1
L-16	Numbers downcast to `address`es may result in collisions	2
L-17	`receive()`/`fallback()` function does not authorize requests	5
L-18	Solidity version 0.8.20 or above may not work on other chains due to PUSH0	41
L-19	Some functions do not work correctly with fee-on-transfer tokens	8
L-20	Some tokens may revert when large transfers are made	8
L-21	Some tokens may revert when zero value transfers are made	8
L-22	Tokens may be minted to `address(0)`	2
L-23	Unsafe downcast	90
L-24	Unsafe solidity low-level call can cause gas grief attack	4
L-25	Consider using `ERC721A` instead of `ERC721`	1
L-26	Using zero as a parameter	16
L-27	Vulnerable versions of packages are being used	1
L-28	Missing zero address check in initializer	1
L-29	`tokenURI()` does not follow EIP-721	1

Non Critical Issues

Total 2903 instances over 103 issues:

ID	Issue	Instances
NC-1	Assembly blocks should have extensive comments	10
NC-2	`abi.encodePacked()` should be replaced with `bytes.concat()`	1
NC-3	Add inline comments for unnamed variables	11
NC-4	Avoid the use of sensitive terms	44
NC-5	The terminating element, `);`, should be placed on the final line by itself	3
NC-6	Multiple `address`/ID mappings can be combined into a single `mapping` of an `address`/ID to a `struct`, for readability	2
NC-7	Complex casting	16
NC-8	Consider adding a block/deny-list	27
NC-9	Consider adding emergency-stop functionality	23
NC-10	Consider adding formal verification proofs	1
NC-11	Consider bounding input array length	2
NC-12	Consider using descriptive `constant`s when passing zero as a function argument	6
NC-13	Constant redefined elsewhere	4
NC-14	Constants should be put on the left side of comparisons	98
NC-15	Variable names for `constant`s should use CONSTANT_CASE	7
NC-16	`Constructor` should emit an event	24
NC-17	Contract does not follow the Solidity Style Guide's suggested layout ordering	192
NC-18	Contract name does not follow the Solidity Style Guide	2
NC-19	Contract should expose an `interface`	85
NC-20	Contract timekeeping will break earlier than the Ethereum network itself will stop working	2
NC-21	Contracts should each be defined in separate files	12
NC-22	Contracts should have full test coverage	1
NC-23	Convert simple `if` statements to ternary expressions	6
NC-24	Events that mark critical parameter changes should contain both the old and the new value	80
NC-25	Custom errors has no error details	36
NC-26	Solidity version is different in some files	2
NC-27	Polymorphic functions make security audits more time-consuming and error-prone	20
NC-28	Duplicated `require()`/`revert()` checks should be refactored	57
NC-29	Empty bytes check is missing	15
NC-30	Enable IR-based code generation	1
NC-31	Enum values should be used instead of constant array indexes	56
NC-32	Events are emitted without the sender information	35
NC-33	Events may be emitted out of order due to reentrancy	16
NC-34	Events should use parameters to convey information	3
NC-35	Execution at deadlines should be allowed	9
NC-36	Function ordering does not follow the Solidity Style Guide	98
NC-37	Functions with array parameters should have length checks in place	18
NC-38	High cyclomatic complexity	14
NC-39	Variable names for `immutable`s should use CONSTANT_CASE	22
NC-40	Import declarations should import specific identifiers, rather than the whole file	34
NC-41	Imports could be organized more systematically	10
NC-42	Inconsistent spacing in comments	2
NC-43	Large or complicated code bases should implement invariant tests	1
NC-44	Large multiples of ten should use scientific notation	12
NC-45	Large numeric literals should use underscores for readability	7
NC-46	Long functions should be refactored into multiple, smaller, functions	26
NC-47	Magic numbers should be replaced with constants	167
NC-48	Missing contract existence checks before low-level calls	4
NC-49	Missing disallow list for `ERC721`	1
NC-50	Named mappings are recommended	22
NC-51	Named imports of parent contracts are missing	13
NC-52	Missing NatSpec from contract declarations	6
NC-53	Missing NatSpec `@author` from contract declaration	22
NC-54	Missing NatSpec `@dev` from contract declaration	29
NC-55	Missing NatSpec `@dev` from event declaration	75
NC-56	Missing NatSpec `@dev` from function declaration	13
NC-57	Event declarations should have NatSpec descriptions	75
NC-58	NatSpec documentation for function is missing	13
NC-59	Public variable declarations should have NatSpec descriptions	98
NC-60	Missing NatSpec `@notice` from contract declaration	46
NC-61	Missing NatSpec `@notice` from event declaration	75
NC-62	Missing NatSpec `@notice` from function declaration	240
NC-63	Missing NatSpec `@param` from event declaration	72
NC-64	Missing NatSpec `@param` from function declaration	20
NC-65	Missing NatSpec `@return` from function declaration	25
NC-66	Missing NatSpec `@title` from contract declaration	21
NC-67	There is no need to initialize variables with 0	52
NC-68	Potential Re-org Attack Vector	9
NC-69	Put all system-wide constants in one file	36
NC-70	Redundant `return` statement in a function with named return variables	2
NC-71	The remaining ETH may be locked in the contract after call	3
NC-72	Setters should prevent re-setting the same value	1
NC-73	State variables should include comments	24
NC-74	The first argument should not be attached to the opening parenthesis	3
NC-75	Lines are too long	29
NC-76	Typos	1
NC-77	Unnecessary cast	23
NC-78	Unsafe conversion from unsigned to signed values	11
NC-79	Unused `error` definition	71
NC-80	Unused `event` definition	1
NC-81	Unused arguments should be removed or implemented	64
NC-82	Unused named return	3
NC-83	Unused contract variables	7
NC-84	Use `abi.encodeCall()` instead of `abi.encodeWithSignature()`/`abi.encodeWithSelector()`	1
NC-85	Consider using `delete` rather than assigning zero/false to clear values	6
NC-86	Solidity compiler version is not fixed	41
NC-87	Expressions for constant values should use `immutable` rather than `constant`	36
NC-88	Use `@inheritdoc` for overridden functions	20
NC-89	Upgrade `openzeppelin` to the latest version (`5.0.1`)	1
NC-90	Use the latest solidity version for deployment (`0.8.23`)	37
NC-91	Consider using modifiers for address control	58
NC-92	Use of `override` is unnecessary	18
NC-93	Returning a struct instead of a bunch of variables is better	1
NC-94	Use a struct to encapsulate multiple function parameters	2
NC-95	Visibility of state variables is not explicitly defined	4
NC-96	Whitespace in Expressions	14
NC-97	Common functions should be refactored to a common base contract	79
NC-98	Empty body - Consider commenting why	4
NC-99	Names of `private`/`internal` state variables should be prefixed with an underscore	3
NC-100	Internal function calls within for loops	3
NC-101	Variables should be named in mixedCase style	4
NC-102	Event is missing `indexed` fields	29
NC-103	Functions not used internally could be marked `external`	12

Gas Optimizations

Total 1555 instances over 53 issues:

ID	Issue	Instances	Gas
GAS-1	Assigning to structs can be more efficient	8	48
GAS-2	Optimize gas by using do-while loops	51	13005
GAS-3	Multiple `address`/ID mappings can be combined into a single `mapping` of an `address`/ID to a `struct`, where appropriate	2	-
GAS-4	Consider activating via-ir for deploying	1	-
GAS-5	Divisions can be `unchecked` to save gas	41	820
GAS-6	Do not calculate constants	4	-
GAS-7	Don't transfer with zero amount to save gas	4	-
GAS-8	Operator `+=` costs more gas than `<x> = <x> + <y>` for state variables	1	113
GAS-9	Duplicated `require()`/`revert()` checks should be refactored to a modifier or function to save gas	57	-
GAS-10	Events should be emitted outside of loops	3	1125
GAS-11	Increments can be `unchecked` to save gas	43	2580
GAS-12	`internal` functions only called once can be inlined to save gas	14	420
GAS-13	Low level `call` can be optimized with assembly	4	992
GAS-14	Multiple accesses of the same mapping/array key/index should be cached	61	2562
GAS-15	Newer versions of solidity are more gas efficient	37	-
GAS-16	Operator `>=`/`<=` costs less gas than operator `>`/`<`	156	468
GAS-17	Optimize Gas by splitting `if() revert` statements	18	-
GAS-18	Optimize names to save gas	20	440
GAS-19	Reduce gas usage by moving to Solidity 0.8.19 or later	27	27000
GAS-20	Redundant state variable getters	1	-
GAS-21	Remove or replace unused state variables	7	-
GAS-22	The result of a function call should be cached rather than re-calling the function	6	600
GAS-23	State variables can be packed into fewer storage slots	1	20000
GAS-24	State variables only set in the constructor should be declared immutable	3	60000
GAS-25	Structs can be packed into fewer storage slots	1	20000
GAS-26	Unlimited gas consumption risk due to external call recipients	4	-
GAS-27	Unused named return variables without optimizer waste gas	3	27
GAS-28	Optimize external calls with assembly for memory efficiency	12	2640
GAS-29	Use assembly to compute hashes to save gas	6	480
GAS-30	Use assembly to emit events	82	3116
GAS-31	Use assembly to validate `msg.sender`	58	-
GAS-32	Use assembly to write address/contract type storage values	81	4050
GAS-33	Using a double `if` statement instead of a logical AND (`&&`)	18	540
GAS-34	Use local variables for emitting	1	97
GAS-35	Use a more recent version of solidity	37	-
GAS-36	Use `storage` instead of `memory` for structs/arrays	9	37800
GAS-37	Use `uint256(1)`/`uint256(2)` instead of `true`/`false` to save gas for changes	6	51300
GAS-38	Use `unchecked` block for safe subtractions	4	340
GAS-39	Using bitmap to store bool states can save gas	5	-
GAS-40	Using `constant`s directly, rather than caching the value, saves gas	12	-
GAS-41	Using `this` to access functions results in an external call, wasting gas	5	500
GAS-42	`abi.encodePacked` is more gas efficient than `abi.encode`	2	-
GAS-43	Use `selfbalance()` instead of `address(this).balance`	5	-
GAS-44	Using bools for storage incurs overhead	6	600
GAS-45	Cache array length outside of loop	16	-
GAS-46	State variables should be cached in stack variables rather than re-reading them from storage	55	5335
GAS-47	Use `calldata` instead of `memory` for function arguments that do not get mutated	60	-
GAS-48	Don't initialize variables with default value	52	-
GAS-49	Usage of `int`s/`uint`s smaller than 32 bytes incurs overhead	276	15180
GAS-50	Constructors can be marked as `payable` to save deployment gas	12	252
GAS-51	Using `private` rather than `public` for constants, saves gas	33	-
GAS-52	Use shift Right/Left instead of division/multiplication if possible	1	-
GAS-53	Using assembly to check for zero can save gas	123	738

Medium Issues

[M-1] Non-compliant `IERC20` tokens may revert with `transfer`

Some IERC20 tokens (e.g. BNB, OMG, USDT) do not implement the standard properly, but they are still accepted by most code that accepts ERC20 tokens.

For example, USDT transfer functions on L1 do not return booleans: when casted to IERC20, their function signatures do not match, and therefore the calls made will revert.

There are 2 instances of this issue:

File: governance/contracts/bridges/FxERC20ChildTunnel.sol

79:         bool success = IERC20(childToken).transfer(to, amount);

Github: [79]

File: governance/contracts/veOLAS.sol

534:         IERC20(token).transfer(msg.sender, amount);

Github: [534]

[M-2] Return values of `transfer()`/`transferFrom()` not checked

Not all ERC20 implementations revert() when there's a failure in transfer() or transferFrom(). The function signature has a boolean return value and they indicate errors that way instead. By not checking the return value, operations that should have marked as failed, may potentially go through without actually transfer anything.

There are 3 instances of this issue:

File: governance/contracts/veOLAS.sol

364:             IERC20(token).transferFrom(msg.sender, address(this), amount);

534:         IERC20(token).transfer(msg.sender, amount);

Github: [364, 534]

File: tokenomics/contracts/Depository.sol

390:         IToken(olas).transfer(msg.sender, payout);

Github: [390]

[M-3] `transfer`/`transferFrom` may never return `true` for some tokens

Some tokens do not return a bool (e.g. USDT, OMG) on transfer. As there are some conditions that rely on this bool value, these tokens may cause issues, as the return value of the following conditions will always be false.

There are 4 instances of this issue:

File: governance/contracts/bridges/FxERC20ChildTunnel.sol

79:         bool success = IERC20(childToken).transfer(to, amount);

102:         bool success = IERC20(childToken).transferFrom(msg.sender, address(this), amount);

Github: [79, 102]

File: governance/contracts/bridges/FxERC20RootTunnel.sol

98:         bool success = IERC20(rootToken).transferFrom(msg.sender, address(this), amount);

Github: [98]

File: tokenomics/contracts/Treasury.sol

235:         bool success = IToken(token).transferFrom(account, address(this), tokenAmount);

Github: [235]

Low Issues

[L-1] Missing zero address check in functions with address parameters

Adding a zero address check for each address type parameter can prevent errors.

There are 85 instances (click to show):

File: governance/contracts/OLAS.sol

/// @audit missing zero check for `account`
75:     function mint(address account, uint256 amount) external {

/// @audit missing zero check for `spender`
128:     function decreaseAllowance(address spender, uint256 amount) external returns (bool) {

/// @audit missing zero check for `spender`
145:     function increaseAllowance(address spender, uint256 amount) external returns (bool) {

Github: [75, 128, 145]

File: governance/contracts/bridges/BridgedERC20.sol

/// @audit missing zero check for `account`
48:     function mint(address account, uint256 amount) external {

Github: [48]

File: governance/contracts/bridges/FxERC20ChildTunnel.sol

/// @audit missing zero check for `to`
90:     function _deposit(address to, uint256 amount) internal {

Github: [90]

File: governance/contracts/bridges/FxERC20RootTunnel.sol

/// @audit missing zero check for `to`
86:     function _withdraw(address to, uint256 amount) internal {

Github: [86]

File: governance/contracts/bridges/FxGovernorTunnel.sol

/// @audit missing zero check for `rootMessageSender`
6:     function processMessageFromRoot(uint256 stateId, address rootMessageSender, bytes memory data) external;

/// @audit missing zero check for `rootMessageSender`
107:     function processMessageFromRoot(uint256 stateId, address rootMessageSender, bytes memory data) external override {

Github: [6, 107]

File: governance/contracts/interfaces/IERC20.sol

/// @audit missing zero check for `account`
9:     function balanceOf(address account) external view returns (uint256);

/// @audit missing zero check for `owner`
/// @audit missing zero check for `spender`
19:     function allowance(address owner, address spender) external view returns (uint256);

/// @audit missing zero check for `spender`
25:     function approve(address spender, uint256 amount) external returns (bool);

/// @audit missing zero check for `to`
31:     function transfer(address to, uint256 amount) external returns (bool);

/// @audit missing zero check for `from`
/// @audit missing zero check for `to`
38:     function transferFrom(address from, address to, uint256 amount) external returns (bool);

/// @audit missing zero check for `account`
43:     function mint(address account, uint256 amount) external;

Github: [9, 19, 25, 31, 38, 43]

File: governance/contracts/multisigs/GuardCM.sol

/// @audit missing zero check for `bridgeMediatorL2`
252:     function _processBridgeData(
             bytes memory data,
             address bridgeMediatorL2,
             uint256 chainId
         ) internal
         {

/// @audit missing zero check for `to`
387:     function checkTransaction(
             address to,
             uint256,
             bytes memory data,
             Enum.Operation operation,
             uint256,
             uint256,
             uint256,
             address,
             address payable,
             bytes memory,
             address
         ) external {

/// @audit missing zero check for `bridgeMediatorL1`
597:     function getBridgeMediatorChainId(address bridgeMediatorL1) external view
             returns (address bridgeMediatorL2, uint256 chainId)
         {

Github: [252, 387, 597]

File: governance/contracts/veOLAS.sol

/// @audit missing zero check for `account`
145:     function getLastUserPoint(address account) external view returns (PointVoting memory pv) {

/// @audit missing zero check for `account`
155:     function getNumUserPoints(address account) external view returns (uint256 accountNumPoints) {

/// @audit missing zero check for `account`
164:     function getUserPoint(address account, uint256 idx) external view returns (PointVoting memory) {

/// @audit missing zero check for `account`
330:     function _depositFor(
             address account,
             uint256 amount,
             uint256 unlockTime,
             LockedBalance memory lockedBalance,
             DepositType depositType
         ) internal {

/// @audit missing zero check for `account`
425:     function _createLockFor(address account, uint256 amount, uint256 unlockTime) private {

/// @audit missing zero check for `account`
593:     function _balanceOfLocked(address account, uint64 ts) internal view returns (uint256 vBalance) {

/// @audit missing zero check for `account`
607:     function balanceOf(address account) public view override returns (uint256 balance) {

/// @audit missing zero check for `account`
614:     function lockedEnd(address account) external view returns (uint256 unlockTime) {

/// @audit missing zero check for `account`
622:     function balanceOfAt(address account, uint256 blockNumber) external view returns (uint256 balance) {

/// @audit missing zero check for `account`
633:     function getVotes(address account) public view override returns (uint256) {

/// @audit missing zero check for `account`
672:     function getPastVotes(address account, uint256 blockNumber) public view override returns (uint256 balance) {

/// @audit missing zero check for `to`
767:     function transfer(address to, uint256 amount) external virtual override returns (bool) {

/// @audit missing zero check for `spender`
772:     function approve(address spender, uint256 amount) external virtual override returns (bool) {

/// @audit missing zero check for `from`
/// @audit missing zero check for `to`
777:     function transferFrom(address from, address to, uint256 amount) external virtual override returns (bool) {

/// @audit missing zero check for `owner`
/// @audit missing zero check for `spender`
782:     function allowance(address owner, address spender) external view virtual override returns (uint256)
         {

/// @audit missing zero check for `account`
788:     function delegates(address account) external view virtual override returns (address)
         {

/// @audit missing zero check for `delegatee`
794:     function delegate(address delegatee) external virtual override
         {

/// @audit missing zero check for `delegatee`
800:     function delegateBySig(address delegatee, uint256 nonce, uint256 expiry, uint8 v, bytes32 r, bytes32 s)
         external virtual override
         {

Github: [145, 155, 164, 330, 425, 593, 607, 614, 622, 633, 672, 767, 772, 777, 782, 788, 794, 800]

File: governance/contracts/wveOLAS.sol

/// @audit missing zero check for `account`
31:     function getLastUserPoint(address account) external view returns (PointVoting memory pv);

/// @audit missing zero check for `account`
36:     function getNumUserPoints(address account) external view returns (uint256 userNumPoints);

/// @audit missing zero check for `account`
43:     function getUserPoint(address account, uint256 idx) external view returns (PointVoting memory uPoint);

/// @audit missing zero check for `account`
49:     function getPastVotes(address account, uint256 blockNumber) external view returns (uint256 balance);

/// @audit missing zero check for `account`
54:     function balanceOf(address account) external view returns (uint256 balance);

/// @audit missing zero check for `account`
60:     function balanceOfAt(address account, uint256 blockNumber) external view returns (uint256 balance);

/// @audit missing zero check for `account`
65:     function lockedEnd(address account) external view returns (uint256 unlockTime);

/// @audit missing zero check for `account`
70:     function getVotes(address account) external view returns (uint256 balance);

/// @audit missing zero check for `owner`
/// @audit missing zero check for `spender`
101:     function allowance(address owner, address spender) external view returns (uint256);

/// @audit missing zero check for `account`
104:     function delegates(address account) external view returns (address);

/// @audit missing zero check for `account`
177:     function getLastUserPoint(address account) external view returns (PointVoting memory pv) {

/// @audit missing zero check for `account`
184:     function getNumUserPoints(address account) external view returns (uint256 userNumPoints) {

/// @audit missing zero check for `account`
193:     function getUserPoint(address account, uint256 idx) public view returns (PointVoting memory uPoint) {

/// @audit missing zero check for `account`
203:     function getVotes(address account) external view returns (uint256 balance) {

/// @audit missing zero check for `account`
211:     function getPastVotes(address account, uint256 blockNumber) external view returns (uint256 balance) {

/// @audit missing zero check for `account`
223:     function balanceOf(address account) external view returns (uint256 balance) {

/// @audit missing zero check for `account`
231:     function balanceOfAt(address account, uint256 blockNumber) external view returns (uint256 balance) {

/// @audit missing zero check for `account`
243:     function lockedEnd(address account) external view returns (uint256 unlockTime) {

/// @audit missing zero check for ``
297:     function transfer(address, uint256) external returns (bool) {

/// @audit missing zero check for ``
302:     function approve(address, uint256) external returns (bool) {

/// @audit missing zero check for ``
/// @audit missing zero check for ``
307:     function transferFrom(address, address, uint256) external returns (bool) {

/// @audit missing zero check for ``
/// @audit missing zero check for ``
312:     function allowance(address, address) external view returns (uint256) {

/// @audit missing zero check for ``
317:     function delegates(address) external view returns (address) {

/// @audit missing zero check for ``
322:     function delegate(address) external
         {

/// @audit missing zero check for ``
328:     function delegateBySig(address, uint256, uint256, uint8, bytes32, bytes32) external
         {

Github: [31, 36, 43, 49, 54, 60, 65, 70, 101, 104, 177, 184, 193, 203, 211, 223, 231, 243, 297, 302, 307, 312, 317, 322, 328]

File: registries/contracts/RegistriesManager.sol

/// @audit missing zero check for `unitOwner`
27:     function create(
            IRegistry.UnitType unitType,
            address unitOwner,
            bytes32 unitHash,
            uint32[] memory dependencies
        ) external returns (uint256 unitId)
        {

Github: [27]

File: registries/contracts/UnitRegistry.sol

/// @audit missing zero check for `unitOwner`
121:     function updateHash(address unitOwner, uint256 unitId, bytes32 unitHash) external virtual
             returns (bool success)
         {

Github: [121]

File: registries/contracts/interfaces/IRegistry.sol

/// @audit missing zero check for `unitOwner`
16:     function create(

/// @audit missing zero check for `owner`
27:     function updateHash(address owner, uint256 unitId, bytes32 unitHash) external returns (bool success);

Github: [16, 27]

File: registries/contracts/multisigs/GnosisSafeMultisig.sol

/// @audit missing zero check for `_singleton`
10:     function createProxyWithNonce(

Github: [10]

File: tokenomics/contracts/DonatorBlacklist.sol

/// @audit missing zero check for `account`
82:     function isDonatorBlacklisted(address account) external view returns (bool status) {

Github: [82]

File: tokenomics/contracts/Tokenomics.sol

/// @audit missing zero check for `_donatorBlacklist`
264:     function initializeTokenomics(
             address _olas,
             address _treasury,
             address _depository,
             address _dispenser,
             address _ve,
             uint256 _epochLen,
             address _componentRegistry,
             address _agentRegistry,
             address _serviceRegistry,
             address _donatorBlacklist
         ) external
         {

/// @audit missing zero check for `account`
1085:     function accountOwnerIncentives(address account, uint256[] memory unitTypes, uint256[] memory unitIds) external
              returns (uint256 reward, uint256 topUp)
          {

/// @audit missing zero check for `account`
1160:     function getOwnerIncentives(address account, uint256[] memory unitTypes, uint256[] memory unitIds) external view
              returns (uint256 reward, uint256 topUp)
          {

Github: [264, 1085, 1160]

File: tokenomics/contracts/Treasury.sol

/// @audit missing zero check for `account`
387:     function withdrawToAccount(address account, uint256 accountRewards, uint256 accountTopUps) external
             returns (bool success)
         {

/// @audit missing zero check for `token`
526:     function isEnabled(address token) external view returns (bool enabled) {

Github: [387, 526]

File: tokenomics/contracts/interfaces/IDonatorBlacklist.sol

/// @audit missing zero check for `account`
9:     function isDonatorBlacklisted(address account) external view returns (bool status);

Github: [9]

File: tokenomics/contracts/interfaces/IGenericBondCalculator.sol

/// @audit missing zero check for `token`
16:     function getCurrentPriceLP(address token) external view returns (uint256 priceLP);

Github: [16]

File: tokenomics/contracts/interfaces/IOLAS.sol

/// @audit missing zero check for `account`
8:     function mint(address account, uint256 amount) external;

Github: [8]

File: tokenomics/contracts/interfaces/IToken.sol

/// @audit missing zero check for `account`
9:     function balanceOf(address account) external view returns (uint256);

/// @audit missing zero check for `to`
24:     function transfer(address to, uint256 amount) external returns (bool);

/// @audit missing zero check for `owner`
/// @audit missing zero check for `spender`
30:     function allowance(address owner, address spender) external view returns (uint256);

/// @audit missing zero check for `spender`
36:     function approve(address spender, uint256 amount) external returns (bool);

/// @audit missing zero check for `from`
/// @audit missing zero check for `to`
43:     function transferFrom(address from, address to, uint256 amount) external returns (bool);

Github: [9, 24, 30, 36, 43]

File: tokenomics/contracts/interfaces/ITokenomics.sol

/// @audit missing zero check for `donator`
19:     function trackServiceDonations(

/// @audit missing zero check for `account`
42:     function accountOwnerIncentives(address account, uint256[] memory unitTypes, uint256[] memory unitIds) external

Github: [19, 42]

File: tokenomics/contracts/interfaces/ITreasury.sol

/// @audit missing zero check for `account`
/// @audit missing zero check for `token`
11:     function depositTokenForOLAS(address account, uint256 tokenAmount, address token, uint256 olaMintAmount) external;

/// @audit missing zero check for `token`
21:     function isEnabled(address token) external view returns (bool enabled);

/// @audit missing zero check for `account`
31:     function withdrawToAccount(address account, uint256 accountRewards, uint256 accountTopUps) external returns (bool success);

Github: [11, 21, 31]

File: tokenomics/contracts/interfaces/IVotingEscrow.sol

/// @audit missing zero check for `account`
8:     function getVotes(address account) external view returns (uint256);

Github: [8]

[L-2] Array is `push()`ed but not `pop()`ed

There is no limit specified on the amount of gas used, so the recipient can use up all of the remaining gas (gasleft()), causing it to revert. Therefore, when calling an external contract, it is necessary to specify a limited amount of gas to forward.

There are 2 instances of this issue:

File: governance/contracts/veOLAS.sol

315:             mapUserPoints[account].push(uNew);

Github: [315]

File: registries/contracts/UnitRegistry.sol

143:         mapUnitIdHashes[unitId].push(unitHash);

Github: [143]

[L-3] Division by zero not prevented

The divisions below take an input parameter that has no zero-value checks, which can cause the functions reverting if zero is passed.

There are 11 instances (click to show):

File: governance/contracts/OLAS.sol

/// @audit `oneYear`
101:         uint256 numYears = (block.timestamp - timeLaunch) / oneYear;

Github: [101]

File: governance/contracts/veOLAS.sol

/// @audit `IMAXTIME`
189:                 uOld.slope = int128(oldLocked.amount) / IMAXTIME;

/// @audit `IMAXTIME`
193:                 uNew.slope = int128(newLocked.amount) / IMAXTIME;

/// @audit `WEEK`
231:             uint64 tStep = (lastCheckpoint / WEEK) * WEEK;

/// @audit `WEEK`
433:             unlockTime = ((block.timestamp + unlockTime) / WEEK) * WEEK;

/// @audit `WEEK`
487:             unlockTime = ((block.timestamp + unlockTime) / WEEK) * WEEK;

/// @audit `WEEK`
692:         uint64 tStep = (lastPoint.ts / WEEK) * WEEK;

Github: [189, 193, 231, 433, 487, 692]

File: tokenomics/contracts/Tokenomics.sol

/// @audit `ONE_YEAR`
925:         uint256 numYears = (block.timestamp - timeLaunch) / ONE_YEAR;

/// @audit `ONE_YEAR`
935:             curInflationPerSecond = getInflationForYear(numYears) / ONE_YEAR;

/// @audit `ONE_YEAR`
1010:         numYears = (block.timestamp + curEpochLen - timeLaunch) / ONE_YEAR;

/// @audit `ONE_YEAR`
1019:             curInflationPerSecond = getInflationForYear(numYears) / ONE_YEAR;

Github: [925, 935, 1010, 1019]

[L-4] Consider implementing two-step procedure for updating protocol addresses

A copy-paste error or a typo may end up bricking protocol functionality, or sending tokens to an address with no known private key. Consider implementing a two-step procedure for updating protocol addresses, where the recipient is set as pending, and must "accept" the assignment by making an affirmative call. A straight forward way of doing this would be to have the target contracts implement EIP-165, and to have the "set" functions ensure that the recipient is of the right interface type.

There are 22 instances (click to show):

File: governance/contracts/OLAS.sol

/// @audit `owner`
43:     function changeOwner(address newOwner) external {

/// @audit `minter`
58:     function changeMinter(address newMinter) external {

Github: [43, 58]

File: governance/contracts/bridges/BridgedERC20.sol

/// @audit `owner`
30:     function changeOwner(address newOwner) external {

Github: [30]

File: governance/contracts/bridges/FxGovernorTunnel.sol

/// @audit `rootGovernor`
81:     function changeRootGovernor(address newRootGovernor) external {

Github: [81]

File: governance/contracts/bridges/HomeMediator.sol

/// @audit `foreignGovernor`
81:     function changeForeignGovernor(address newForeignGovernor) external {

Github: [81]

File: governance/contracts/multisigs/GuardCM.sol

/// @audit `governor`
154:     function changeGovernor(address newGovernor) external {

Github: [154]

File: registries/contracts/GenericManager.sol

/// @audit `owner`
20:     function changeOwner(address newOwner) external virtual {

Github: [20]

File: registries/contracts/GenericRegistry.sol

/// @audit `owner`
37:     function changeOwner(address newOwner) external virtual {

/// @audit `manager`
54:     function changeManager(address newManager) external virtual {

Github: [37, 54]

File: registries/contracts/multisigs/GnosisSafeMultisig.sol

/// @audit `multisig`
91:     function create(
            address[] memory owners,
            uint256 threshold,
            bytes memory data
        ) external returns (address multisig)
        {

Github: [91]

File: tokenomics/contracts/Depository.sol

/// @audit `owner`
123:     function changeOwner(address newOwner) external {

/// @audit `tokenomics`
/// @audit `treasury`
143:     function changeManagers(address _tokenomics, address _treasury) external {

/// @audit `bondCalculator`
163:     function changeBondCalculator(address _bondCalculator) external {

Github: [123, 143, 163]

File: tokenomics/contracts/Dispenser.sol

/// @audit `owner`
46:     function changeOwner(address newOwner) external {

/// @audit `tokenomics`
/// @audit `treasury`
64:     function changeManagers(address _tokenomics, address _treasury) external {

Github: [46, 64]

File: tokenomics/contracts/DonatorBlacklist.sol

/// @audit `owner`
36:     function changeOwner(address newOwner) external {

Github: [36]

File: tokenomics/contracts/Tokenomics.sol

/// @audit `owner`
404:     function changeOwner(address newOwner) external {

/// @audit `treasury`
/// @audit `depository`
/// @audit `dispenser`
423:     function changeManagers(address _treasury, address _depository, address _dispenser) external {

/// @audit `componentRegistry`
/// @audit `agentRegistry`
/// @audit `serviceRegistry`
450:     function changeRegistries(address _componentRegistry, address _agentRegistry, address _serviceRegistry) external {

/// @audit `donatorBlacklist`
474:     function changeDonatorBlacklist(address _donatorBlacklist) external {

Github: [404, 423, 450, 474]

File: tokenomics/contracts/Treasury.sol

/// @audit `owner`
137:     function changeOwner(address newOwner) external {

/// @audit `tokenomics`
/// @audit `depository`
/// @audit `dispenser`
156:     function changeManagers(address _tokenomics, address _depository, address _dispenser) external {

Github: [137, 156]

[L-5] Constructor / initialization function lacks parameter validation

Constructors and initialization functions play a critical role in contracts by setting important initial states when the contract is first deployed before the system starts. The parameters passed to the constructor and initialization functions directly affect the behavior of the contract / protocol. If incorrect parameters are provided, the system may fail to run, behave abnormally, be unstable, or lack security. Therefore, it's crucial to carefully check each parameter in the constructor and initialization functions. If an exception is found, the transaction should be rolled back.

There are 9 instances of this issue:

File: governance/contracts/GovernorOLAS.sol

/// @audit `initialVotingDelay` not validated
/// @audit `initialVotingPeriod` not validated
/// @audit `initialProposalThreshold` not validated
16:     constructor(

Github: [16]

File: governance/contracts/Timelock.sol

/// @audit `minDelay` not validated
/// @audit `proposers` not validated
/// @audit `executors` not validated
10:     constructor(uint256 minDelay, address[] memory proposers, address[] memory executors)

Github: [10]

File: governance/contracts/bridges/BridgedERC20.sol

/// @audit `_name` not validated
/// @audit `_symbol` not validated
/// @audit `_decimals` not validated
24:     constructor(string memory _name, string memory _symbol, uint8 _decimals) ERC20(_name, _symbol, _decimals) {

Github: [24]

File: governance/contracts/veOLAS.sol

/// @audit `_token` not validated
/// @audit `_name` not validated
/// @audit `_symbol` not validated
132:     constructor(address _token, string memory _name, string memory _symbol)

Github: [132]

File: registries/contracts/AgentRegistry.sol

/// @audit `_name` not validated
/// @audit `_symbol` not validated
/// @audit `_baseURI` not validated
/// @audit `_componentRegistry` not validated
20:     constructor(string memory _name, string memory _symbol, string memory _baseURI, address _componentRegistry)

Github: [20]

File: registries/contracts/ComponentRegistry.sol

/// @audit `_name` not validated
/// @audit `_symbol` not validated
/// @audit `_baseURI` not validated
16:     constructor(string memory _name, string memory _symbol, string memory _baseURI)

Github: [16]

File: registries/contracts/RegistriesManager.sol

/// @audit `_componentRegistry` not validated
/// @audit `_agentRegistry` not validated
15:     constructor(address _componentRegistry, address _agentRegistry) {

Github: [15]

File: registries/contracts/UnitRegistry.sol

/// @audit `_unitType` not validated
35:     constructor(UnitType _unitType) {

Github: [35]

File: registries/contracts/multisigs/GnosisSafeMultisig.sol

/// @audit `_gnosisSafe` not validated
/// @audit `_gnosisSafeProxyFactory` not validated
37:     constructor (address payable _gnosisSafe, address _gnosisSafeProxyFactory) {

Github: [37]

[L-6] Code does not follow the best practice of check-effects-interaction

Code should follow the best-practice of check-effects-interaction, where state variables are updated before any external calls are made. Doing so prevents a large class of reentrancy bugs.

There are 19 instances (click to show):

File: governance/contracts/multisigs/GuardCM.sol

/// @audit `.state(...)` is called on line 545
547:                 paused = 2;

Github: [547]

File: tokenomics/contracts/Depository.sol

/// @audit `.isEnabled(...)` is called on line 221
/// @audit `.reserveAmountForBondProgram(...)` is called on line 226
/// @audit `.effectiveBond(...)` is called on line 227
232:         mapBondProducts[productId] = Product(uint160(priceLP), uint32(vesting), token, uint96(supply));

/// @audit `.isEnabled(...)` is called on line 221
/// @audit `.reserveAmountForBondProgram(...)` is called on line 226
/// @audit `.effectiveBond(...)` is called on line 227
234:         productCounter = uint32(productId + 1);

/// @audit `.calculatePayoutOLAS(...)` is called on line 320
328:         supply -= payout;

/// @audit `.calculatePayoutOLAS(...)` is called on line 320
333:         mapUserBonds[bondId] = Bond(msg.sender, uint96(payout), uint32(maturity), uint32(productId));

/// @audit `.calculatePayoutOLAS(...)` is called on line 320
334:         bondCounter = uint32(bondId + 1);

Github: [232, 234, 328, 333, 334]

File: tokenomics/contracts/Dispenser.sol

/// @audit `.accountOwnerIncentives(...)` is called on line 99
/// @audit `.withdrawToAccount(...)` is called on line 104
114:         _locked = 1;

Github: [114]

File: tokenomics/contracts/Tokenomics.sol

/// @audit `.timeLaunch(...)` is called on line 318
330:         inflationPerSecond = uint96(_inflationPerSecond);

/// @audit `.timeLaunch(...)` is called on line 318
331:         timeLaunch = uint32(_timeLaunch);

/// @audit `.timeLaunch(...)` is called on line 318
337:         epochCounter = 1;

/// @audit `.timeLaunch(...)` is called on line 318
341:         devsPerCapital = 1e18;

/// @audit `.timeLaunch(...)` is called on line 318
357:         codePerDev = 1e18;

/// @audit `.timeLaunch(...)` is called on line 318
368:         maxBond = uint96(_maxBond);

/// @audit `.timeLaunch(...)` is called on line 318
369:         effectiveBond = uint96(_maxBond);

/// @audit `.ownerOf(...)` is called on line 708
/// @audit `.getVotes(...)` is called on line 709
/// @audit `.getVotes(...)` is called on line 710
761:                         mapNewUnits[unitType][serviceUnitIds[j]] = true;

/// @audit `.ownerOf(...)` is called on line 708
/// @audit `.getVotes(...)` is called on line 709
/// @audit `.getVotes(...)` is called on line 710
/// @audit `.ownerOf(...)` is called on line 765
767:                             mapNewOwners[unitOwner] = true;

/// @audit `.isDonatorBlacklisted(...)` is called on line 801
/// @audit `.exists(...)` is called on line 810
824:         lastDonationBlockNumber = uint32(block.number);

/// @audit `.rebalanceTreasury(...)` is called on line 1063
1067:             epochCounter = uint32(eCounter + 1);

Github: [330, 331, 337, 341, 357, 368, 369, 761, 767, 824, 1067]

File: tokenomics/contracts/Treasury.sol

/// @audit `.trackServiceDonations(...)` is called on line 298
300:         _locked = 1;

Github: [300]

[L-7] External call recipient can consume all remaining gas

There is no limit specified on the amount of gas used, so the recipient can use up all of the remaining gas (gasleft()), causing it to revert. Therefore, when calling an external contract, it is necessary to specify a limited amount of gas to forward.

There are 4 instances of this issue:

File: governance/contracts/bridges/HomeMediator.sol

160:             (bool success, ) = target.call{value: value}(payload);

Github: [160]

File: registries/contracts/multisigs/GnosisSafeSameAddressMultisig.sol

118:             (bool success, ) = multisig.call(payload);

Github: [118]

File: tokenomics/contracts/Treasury.sol

339:                 (success, ) = to.call{value: tokenAmount}("");

406:             (success, ) = account.call{value: accountRewards}("");

Github: [339, 406]

[L-8] External function calls within loops

Calling external functions within loops can easily result in insufficient gas. This greatly increases the likelihood of transaction failures, DOS attacks, and other unexpected actions. It is recommended to limit the number of loops within loops that call external functions, and to limit the gas line for each external call.

There are 12 instances (click to show):

File: tokenomics/contracts/Depository.sol

/// @audit `.refundFromBondProgram(...)`
262:                 ITokenomics(tokenomics).refundFromBondProgram(supply);

Github: [262]

File: tokenomics/contracts/Tokenomics.sol

/// @audit `.ownerOf(...)`
708:                 address serviceOwner = IToken(serviceRegistry).ownerOf(serviceIds[i]);

/// @audit `.getVotes(...)`
709:                 topUpEligible = (IVotingEscrow(ve).getVotes(serviceOwner) >= veOLASThreshold  ||

/// @audit `.getVotes(...)`
710:                     IVotingEscrow(ve).getVotes(donator) >= veOLASThreshold) ? true : false;

/// @audit `.ownerOf(...)`
765:                         address unitOwner = IToken(registries[unitType]).ownerOf(serviceUnitIds[j]);

/// @audit `.ownerOf(...)`
765:                         address unitOwner = IToken(registries[unitType]).ownerOf(serviceUnitIds[j]);

/// @audit `.ownerOf(...)`
765:                         address unitOwner = IToken(registries[unitType]).ownerOf(serviceUnitIds[j]);

/// @audit `.exists(...)`
810:             if (!IServiceRegistry(serviceRegistry).exists(serviceIds[i])) {

/// @audit `.totalSupply(...)`
1105:             registriesSupply[i] = IToken(registries[i]).totalSupply();

/// @audit `.ownerOf(...)`
1123:             address unitOwner = IToken(registries[unitTypes[i]]).ownerOf(unitIds[i]);

/// @audit `.totalSupply(...)`
1175:             registriesSupply[i] = IToken(registries[i]).totalSupply();

/// @audit `.ownerOf(...)`
1193:             address unitOwner = IToken(registries[unitTypes[i]]).ownerOf(unitIds[i]);

Github: [708, 709, 710, 765, 765, 765, 810, 1105, 1123, 1175, 1193]

[L-9] Loss of precision in divisions

Division by large numbers may result in the result being zero, due to solidity not supporting fractions. Consider requiring a minimum amount for the numerator to ensure that it is always larger than the denominator.

There are 13 instances (click to show):

File: governance/contracts/OLAS.sol

101:         uint256 numYears = (block.timestamp - timeLaunch) / oneYear;

Github: [101]

File: governance/contracts/veOLAS.sol

231:             uint64 tStep = (lastCheckpoint / WEEK) * WEEK;

433:             unlockTime = ((block.timestamp + unlockTime) / WEEK) * WEEK;

487:             unlockTime = ((block.timestamp + unlockTime) / WEEK) * WEEK;

664:             blockTime += (dt * (blockNumber - point.blockNumber)) / dBlock;

692:         uint64 tStep = (lastPoint.ts / WEEK) * WEEK;

Github: [231, 433, 487, 664, 692]

File: tokenomics/contracts/GenericBondCalculator.sol

89:                 priceLP = (reserve1 * 1e18) / totalSupply;

Github: [89]

File: tokenomics/contracts/Tokenomics.sol

925:         uint256 numYears = (block.timestamp - timeLaunch) / ONE_YEAR;

933:             inflationPerEpoch = (yearEndTime - prevEpochTime) * curInflationPerSecond;

937:             inflationPerEpoch += (block.timestamp - yearEndTime) * curInflationPerSecond;

1010:         numYears = (block.timestamp + curEpochLen - timeLaunch) / ONE_YEAR;

1017:             inflationPerEpoch = (yearEndTime - block.timestamp) * curInflationPerSecond;

1021:             inflationPerEpoch += (block.timestamp + curEpochLen - yearEndTime) * curInflationPerSecond;

Github: [925, 933, 937, 1010, 1017, 1021]

[L-10] Missing checks for state variable assignments

There are some missing checks in these functions, and this could lead to unexpected scenarios. Consider always adding a sanity check for state variables.

There are 78 instances (click to show):

File: governance/contracts/OLAS.sol

/// @audit `newOwner`
52:         owner = newOwner;

/// @audit `newMinter`
67:         minter = newMinter;

Github: [52, 67]

File: governance/contracts/bridges/BridgedERC20.sol

/// @audit `newOwner`
41:         owner = newOwner;

Github: [41]

File: governance/contracts/bridges/FxERC20ChildTunnel.sol

/// @audit `_childToken`
43:         childToken = _childToken;

/// @audit `_rootToken`
44:         rootToken = _rootToken;

Github: [43, 44]

File: governance/contracts/bridges/FxERC20RootTunnel.sol

/// @audit `_childToken`
47:         childToken = _childToken;

/// @audit `_rootToken`
48:         rootToken = _rootToken;

Github: [47, 48]

File: governance/contracts/bridges/FxGovernorTunnel.sol

/// @audit `_fxChild`
68:         fxChild = _fxChild;

/// @audit `_rootGovernor`
69:         rootGovernor = _rootGovernor;

/// @audit `newRootGovernor`
93:         rootGovernor = newRootGovernor;

Github: [68, 69, 93]

File: governance/contracts/bridges/HomeMediator.sol

/// @audit `_AMBContractProxyHome`
68:         AMBContractProxyHome = _AMBContractProxyHome;

/// @audit `_foreignGovernor`
69:         foreignGovernor = _foreignGovernor;

/// @audit `newForeignGovernor`
93:         foreignGovernor = newForeignGovernor;

Github: [68, 69, 93]

File: governance/contracts/multisigs/GuardCM.sol

/// @audit `_timelock`
147:         owner = _timelock;

/// @audit `_multisig`
148:         multisig = _multisig;

/// @audit `_governor`
149:         governor = _governor;

/// @audit `newGovernor`
164:         governor = newGovernor;

/// @audit `proposalId`
180:         governorCheckProposalId = proposalId;

Github: [147, 148, 149, 164, 180]

File: governance/contracts/veOLAS.sol

/// @audit `_token`
134:         token = _token;

/// @audit `_name`
135:         name = _name;

/// @audit `_symbol`
136:         symbol = _symbol;

/// @audit `lockedBalance`
355:         mapLockedBalances[account] = lockedBalance;

Github: [134, 135, 136, 355]

File: governance/contracts/wveOLAS.sol

/// @audit `_ve`
150:         ve = _ve;

/// @audit `_token`
151:         token = _token;

Github: [150, 151]

File: registries/contracts/AgentRegistry.sol

/// @audit `_baseURI`
24:         baseURI = _baseURI;

/// @audit `_componentRegistry`
25:         componentRegistry = _componentRegistry;

Github: [24, 25]

File: registries/contracts/ComponentRegistry.sol

/// @audit `_baseURI`
20:         baseURI = _baseURI;

Github: [20]

File: registries/contracts/GenericManager.sol

/// @audit `newOwner`
31:         owner = newOwner;

Github: [31]

File: registries/contracts/GenericRegistry.sol

/// @audit `newOwner`
48:         owner = newOwner;

/// @audit `newManager`
64:         manager = newManager;

/// @audit `bURI`
89:         baseURI = bURI;

Github: [48, 64, 89]

File: registries/contracts/RegistriesManager.sol

/// @audit `_componentRegistry`
16:         componentRegistry = _componentRegistry;

/// @audit `_agentRegistry`
17:         agentRegistry = _agentRegistry;

Github: [16, 17]

File: registries/contracts/UnitRegistry.sol

/// @audit `_unitType`
36:         unitType = _unitType;

Github: [36]

File: registries/contracts/multisigs/GnosisSafeMultisig.sol

/// @audit `_gnosisSafe`
38:         gnosisSafe = _gnosisSafe;

/// @audit `_gnosisSafeProxyFactory`
39:         gnosisSafeProxyFactory = _gnosisSafeProxyFactory;

Github: [38, 39]

File: registries/contracts/multisigs/GnosisSafeSameAddressMultisig.sol

/// @audit `_proxyHash`
66:         proxyHash = _proxyHash;

Github: [66]

File: tokenomics/contracts/Depository.sol

/// @audit `_olas`
114:         olas = _olas;

/// @audit `_tokenomics`
115:         tokenomics = _tokenomics;

/// @audit `_treasury`
116:         treasury = _treasury;

/// @audit `_bondCalculator`
117:         bondCalculator = _bondCalculator;

/// @audit `newOwner`
134:         owner = newOwner;

/// @audit `_tokenomics`
151:             tokenomics = _tokenomics;

/// @audit `_treasury`
156:             treasury = _treasury;

/// @audit `_bondCalculator`
170:             bondCalculator = _bondCalculator;

Github: [114, 115, 116, 117, 134, 151, 156, 170]

File: tokenomics/contracts/Dispenser.sol

/// @audit `_tokenomics`
40:         tokenomics = _tokenomics;

/// @audit `_treasury`
41:         treasury = _treasury;

/// @audit `newOwner`
57:         owner = newOwner;

/// @audit `_tokenomics`
72:             tokenomics = _tokenomics;

/// @audit `_treasury`
77:             treasury = _treasury;

Github: [40, 41, 57, 72, 77]

File: tokenomics/contracts/DonatorBlacklist.sol

/// @audit `newOwner`
47:         owner = newOwner;

Github: [47]

File: tokenomics/contracts/GenericBondCalculator.sol

/// @audit `_olas`
35:         olas = _olas;

/// @audit `_tokenomics`
36:         tokenomics = _tokenomics;

Github: [35, 36]

File: tokenomics/contracts/Tokenomics.sol

/// @audit `_olas`
306:         olas = _olas;

/// @audit `_treasury`
307:         treasury = _treasury;

/// @audit `_depository`
308:         depository = _depository;

/// @audit `_dispenser`
309:         dispenser = _dispenser;

/// @audit `_ve`
310:         ve = _ve;

/// @audit `_componentRegistry`
312:         componentRegistry = _componentRegistry;

/// @audit `_agentRegistry`
313:         agentRegistry = _agentRegistry;

/// @audit `_serviceRegistry`
314:         serviceRegistry = _serviceRegistry;

/// @audit `_donatorBlacklist`
315:         donatorBlacklist = _donatorBlacklist;

/// @audit `newOwner`
415:         owner = newOwner;

/// @audit `_treasury`
431:             treasury = _treasury;

/// @audit `_depository`
436:             depository = _depository;

/// @audit `_dispenser`
441:             dispenser = _dispenser;

/// @audit `_componentRegistry`
458:             componentRegistry = _componentRegistry;

/// @audit `_agentRegistry`
462:             agentRegistry = _agentRegistry;

/// @audit `_serviceRegistry`
466:             serviceRegistry = _serviceRegistry;

/// @audit `_donatorBlacklist`
480:         donatorBlacklist = _donatorBlacklist;

Github: [306, 307, 308, 309, 310, 312, 313, 314, 315, 415, 431, 436, 441, 458, 462, 466, 480]

File: tokenomics/contracts/Treasury.sol

/// @audit `_olas`
104:         olas = _olas;

/// @audit `_tokenomics`
105:         tokenomics = _tokenomics;

/// @audit `_depository`
106:         depository = _depository;

/// @audit `_dispenser`
107:         dispenser = _dispenser;

/// @audit `newOwner`
148:         owner = newOwner;

/// @audit `_tokenomics`
164:             tokenomics = _tokenomics;

/// @audit `_depository`
169:             depository = _depository;

/// @audit `_dispenser`
174:             dispenser = _dispenser;

Github: [104, 105, 106, 107, 148, 164, 169, 174]

[L-11] Missing limits when setting min/max amounts

There are some missing limits in these functions, and this could lead to unexpected scenarios. Consider adding a min/max limit for the following values, when appropriate.

There is one instance of this issue:

File: governance/contracts/multisigs/GuardCM.sol

/// @audit `proposalId`
170:     function changeGovernorCheckProposalId(uint256 proposalId) external {

Github: [170]

[L-12] Missing zero address check in constructor

Constructors often take address parameters to initialize important components of a contract, such as owner or linked contracts. However, without a checking, there's a risk that an address parameter could be mistakenly set to the zero address (0x0). This could be due to an error or oversight during contract deployment. A zero address in a crucial role can cause serious issues, as it cannot perform actions like a normal address, and any funds sent to it will be irretrievable. It's therefore crucial to include a zero address check in constructors to prevent such potential problems. If a zero address is detected, the constructor should revert the transaction.

There are 4 instances of this issue:

File: governance/contracts/veOLAS.sol

/// @audit missing zero check for `_token`
132:     constructor(address _token, string memory _name, string memory _symbol)
         {

Github: [132]

File: registries/contracts/AgentRegistry.sol

/// @audit missing zero check for `_componentRegistry`
20:     constructor(string memory _name, string memory _symbol, string memory _baseURI, address _componentRegistry)
            UnitRegistry(UnitType.Agent)
            ERC721(_name, _symbol)
        {

Github: [20]

File: registries/contracts/RegistriesManager.sol

/// @audit missing zero check for `_componentRegistry`
/// @audit missing zero check for `_agentRegistry`
15:     constructor(address _componentRegistry, address _agentRegistry) {

Github: [15]

File: registries/contracts/multisigs/GnosisSafeMultisig.sol

/// @audit missing zero check for `_gnosisSafe`
/// @audit missing zero check for `_gnosisSafeProxyFactory`
37:     constructor (address payable _gnosisSafe, address _gnosisSafeProxyFactory) {

Github: [37]

[L-13] Consider some checks for `address(0)` when setting address state variables

Check for zero-address to avoid the risk of setting address(0) for state variables after an update.

There are 69 instances (click to show):

File: governance/contracts/OLAS.sol

/// @audit `newOwner`
52:         owner = newOwner;

/// @audit `newMinter`
67:         minter = newMinter;

Github: [52, 67]

File: governance/contracts/bridges/BridgedERC20.sol

/// @audit `newOwner`
41:         owner = newOwner;

Github: [41]

File: governance/contracts/bridges/FxERC20ChildTunnel.sol

/// @audit `_childToken`
43:         childToken = _childToken;

/// @audit `_rootToken`
44:         rootToken = _rootToken;

Github: [43, 44]

File: governance/contracts/bridges/FxERC20RootTunnel.sol

/// @audit `_childToken`
47:         childToken = _childToken;

/// @audit `_rootToken`
48:         rootToken = _rootToken;

Github: [47, 48]

File: governance/contracts/bridges/FxGovernorTunnel.sol

/// @audit `_fxChild`
68:         fxChild = _fxChild;

/// @audit `_rootGovernor`
69:         rootGovernor = _rootGovernor;

/// @audit `newRootGovernor`
93:         rootGovernor = newRootGovernor;

Github: [68, 69, 93]

File: governance/contracts/bridges/HomeMediator.sol

/// @audit `_AMBContractProxyHome`
68:         AMBContractProxyHome = _AMBContractProxyHome;

/// @audit `_foreignGovernor`
69:         foreignGovernor = _foreignGovernor;

/// @audit `newForeignGovernor`
93:         foreignGovernor = newForeignGovernor;

Github: [68, 69, 93]

File: governance/contracts/multisigs/GuardCM.sol

/// @audit `_timelock`
147:         owner = _timelock;

/// @audit `_multisig`
148:         multisig = _multisig;

/// @audit `_governor`
149:         governor = _governor;

/// @audit `newGovernor`
164:         governor = newGovernor;

Github: [147, 148, 149, 164]

File: governance/contracts/veOLAS.sol

/// @audit `_token`
134:         token = _token;

Github: [134]

File: governance/contracts/wveOLAS.sol

/// @audit `_ve`
150:         ve = _ve;

/// @audit `_token`
151:         token = _token;

Github: [150, 151]

File: registries/contracts/AgentRegistry.sol

/// @audit `_componentRegistry`
25:         componentRegistry = _componentRegistry;

Github: [25]

File: registries/contracts/GenericManager.sol

/// @audit `newOwner`
31:         owner = newOwner;

Github: [31]

File: registries/contracts/GenericRegistry.sol

/// @audit `newOwner`
48:         owner = newOwner;

/// @audit `newManager`
64:         manager = newManager;

Github: [48, 64]

File: registries/contracts/RegistriesManager.sol

/// @audit `_componentRegistry`
16:         componentRegistry = _componentRegistry;

/// @audit `_agentRegistry`
17:         agentRegistry = _agentRegistry;

Github: [16, 17]

File: registries/contracts/multisigs/GnosisSafeMultisig.sol

/// @audit `_gnosisSafe`
38:         gnosisSafe = _gnosisSafe;

/// @audit `_gnosisSafeProxyFactory`
39:         gnosisSafeProxyFactory = _gnosisSafeProxyFactory;

Github: [38, 39]

File: tokenomics/contracts/Depository.sol

/// @audit `_olas`
114:         olas = _olas;

/// @audit `_tokenomics`
115:         tokenomics = _tokenomics;

/// @audit `_treasury`
116:         treasury = _treasury;

/// @audit `_bondCalculator`
117:         bondCalculator = _bondCalculator;

/// @audit `newOwner`
134:         owner = newOwner;

/// @audit `_tokenomics`
151:             tokenomics = _tokenomics;

/// @audit `_treasury`
156:             treasury = _treasury;

/// @audit `_bondCalculator`
170:             bondCalculator = _bondCalculator;

Github: [114, 115, 116, 117, 134, 151, 156, 170]

File: tokenomics/contracts/Dispenser.sol

/// @audit `_tokenomics`
40:         tokenomics = _tokenomics;

/// @audit `_treasury`
41:         treasury = _treasury;

/// @audit `newOwner`
57:         owner = newOwner;

/// @audit `_tokenomics`
72:             tokenomics = _tokenomics;

/// @audit `_treasury`
77:             treasury = _treasury;

Github: [40, 41, 57, 72, 77]

File: tokenomics/contracts/DonatorBlacklist.sol

/// @audit `newOwner`
47:         owner = newOwner;

Github: [47]

File: tokenomics/contracts/GenericBondCalculator.sol

/// @audit `_olas`
35:         olas = _olas;

/// @audit `_tokenomics`
36:         tokenomics = _tokenomics;

Github: [35, 36]

File: tokenomics/contracts/Tokenomics.sol

/// @audit `_olas`
306:         olas = _olas;

/// @audit `_treasury`
307:         treasury = _treasury;

/// @audit `_depository`
308:         depository = _depository;

/// @audit `_dispenser`
309:         dispenser = _dispenser;

/// @audit `_ve`
310:         ve = _ve;

/// @audit `_componentRegistry`
312:         componentRegistry = _componentRegistry;

/// @audit `_agentRegistry`
313:         agentRegistry = _agentRegistry;

/// @audit `_serviceRegistry`
314:         serviceRegistry = _serviceRegistry;

/// @audit `_donatorBlacklist`
315:         donatorBlacklist = _donatorBlacklist;

/// @audit `newOwner`
415:         owner = newOwner;

/// @audit `_treasury`
431:             treasury = _treasury;

/// @audit `_depository`
436:             depository = _depository;

/// @audit `_dispenser`
441:             dispenser = _dispenser;

/// @audit `_componentRegistry`
458:             componentRegistry = _componentRegistry;

/// @audit `_agentRegistry`
462:             agentRegistry = _agentRegistry;

/// @audit `_serviceRegistry`
466:             serviceRegistry = _serviceRegistry;

/// @audit `_donatorBlacklist`
480:         donatorBlacklist = _donatorBlacklist;

Github: [306, 307, 308, 309, 310, 312, 313, 314, 315, 415, 431, 436, 441, 458, 462, 466, 480]

File: tokenomics/contracts/Treasury.sol

/// @audit `_olas`
104:         olas = _olas;

/// @audit `_tokenomics`
105:         tokenomics = _tokenomics;

/// @audit `_depository`
106:         depository = _depository;

/// @audit `_dispenser`
107:         dispenser = _dispenser;

/// @audit `newOwner`
148:         owner = newOwner;

/// @audit `_tokenomics`
164:             tokenomics = _tokenomics;

/// @audit `_depository`
169:             depository = _depository;

/// @audit `_dispenser`
174:             dispenser = _dispenser;

Github: [104, 105, 106, 107, 148, 164, 169, 174]

[L-14] Multiplication on the result of a division

Dividing an integer by another integer will often result in loss of precision. When the result is multiplied by another number, the loss of precision is magnified, often to material magnitudes. (X / Z) * Y should be re-written as (X * Y) / Z

There are 4 instances of this issue:

File: governance/contracts/veOLAS.sol

231:             uint64 tStep = (lastCheckpoint / WEEK) * WEEK;

433:             unlockTime = ((block.timestamp + unlockTime) / WEEK) * WEEK;

487:             unlockTime = ((block.timestamp + unlockTime) / WEEK) * WEEK;

692:         uint64 tStep = (lastPoint.ts / WEEK) * WEEK;

Github: [231, 433, 487, 692]

[L-15] NFT doesn't handle hard forks

To ensure clarity regarding the ownership of the NFT on a specific chain, it is recommended to add require(block.chainid == 1, "Invalid Chain") or the desired chain ID in the functions below.

Alternatively, consider including the chain ID in the URI itself. By doing so, any confusion regarding the chain responsible for owning the NFT will be eliminated.

There is one instance of this issue:

File: registries/contracts/GenericRegistry.sol

135:     function tokenURI(uint256 unitId) public view virtual override returns (string memory) {

Github: [135]

[L-16] Numbers downcast to `address`es may result in collisions

If a number is downcast to an address the upper bytes are truncated, which may mean that more than one value will map to the address.

There are 2 instances of this issue:

File: governance/contracts/multisigs/GuardCM.sol

364:             address bridgeMediatorL2 = address(uint160(bridgeMediatorL2ChainId));

603:         bridgeMediatorL2 = address(uint160(bridgeMediatorL2ChainId));

Github: [364, 603]

[L-17] `receive()`/`fallback()` function does not authorize requests

Having no access control on the function (e.g. require(msg.sender == address(weth))) means that someone may send Ether to the contract, and have no way to get anything back out, which is a loss of funds. If the concern is having to spend a small amount of gas to check the sender against an immutable address, the code should at least have a function to rescue mistakenly-sent Ether.

There are 5 instances of this issue:

File: governance/contracts/bridges/FxGovernorTunnel.sol

73:     receive() external payable {

Github: [73]

File: governance/contracts/bridges/HomeMediator.sol

73:     receive() external payable {

Github: [73]

File: governance/contracts/wveOLAS.sol

334:     fallback() external {

Github: [334]

File: tokenomics/contracts/TokenomicsProxy.sol

55:     fallback() external {

Github: [55]

File: tokenomics/contracts/Treasury.sol

120:     receive() external payable {

Github: [120]

[L-18] Solidity version 0.8.20 or above may not work on other chains due to PUSH0

Solidity version 0.8.20 or above uses the new Shanghai EVM which introduces the PUSH0 opcode. This op code may not yet be implemented on all evm-chains or Layer2s, so deployment on these chains will fail. Consider using an earlier solidity version.

There are 41 instances (click to show):

File: governance/contracts/GovernorOLAS.sol

2: pragma solidity ^0.8.20;

Github: [2]

File: governance/contracts/OLAS.sol

2: pragma solidity ^0.8.15;

Github: [2]

File: governance/contracts/Timelock.sol

2: pragma solidity ^0.8.20;

Github: [2]

File: governance/contracts/bridges/BridgedERC20.sol

2: pragma solidity ^0.8.23;

Github: [2]

File: governance/contracts/bridges/FxERC20ChildTunnel.sol

2: pragma solidity ^0.8.23;

Github: [2]

File: governance/contracts/bridges/FxERC20RootTunnel.sol

2: pragma solidity ^0.8.23;

Github: [2]

File: governance/contracts/bridges/FxGovernorTunnel.sol

2: pragma solidity ^0.8.19;

Github: [2]

File: governance/contracts/bridges/HomeMediator.sol

2: pragma solidity ^0.8.19;

Github: [2]

File: governance/contracts/interfaces/IERC20.sol

2: pragma solidity ^0.8.21;

Github: [2]

File: governance/contracts/interfaces/IErrors.sol

2: pragma solidity ^0.8.15;

Github: [2]

File: governance/contracts/multisigs/GuardCM.sol

2: pragma solidity ^0.8.23;

Github: [2]

File: governance/contracts/veOLAS.sol

2: pragma solidity ^0.8.15;

Github: [2]

File: governance/contracts/wveOLAS.sol

2: pragma solidity ^0.8.19;

Github: [2]

File: registries/contracts/AgentRegistry.sol

2: pragma solidity ^0.8.15;

Github: [2]

File: registries/contracts/ComponentRegistry.sol

2: pragma solidity ^0.8.15;

Github: [2]

File: registries/contracts/GenericManager.sol

2: pragma solidity ^0.8.15;

Github: [2]

File: registries/contracts/GenericRegistry.sol

2: pragma solidity ^0.8.15;

Github: [2]

File: registries/contracts/RegistriesManager.sol

2: pragma solidity ^0.8.15;

Github: [2]

File: registries/contracts/UnitRegistry.sol

2: pragma solidity ^0.8.15;

Github: [2]

File: registries/contracts/interfaces/IErrorsRegistries.sol

2: pragma solidity ^0.8.15;

Github: [2]

File: registries/contracts/interfaces/IRegistry.sol

2: pragma solidity ^0.8.15;

Github: [2]

File: registries/contracts/multisigs/GnosisSafeMultisig.sol

2: pragma solidity ^0.8.15;

Github: [2]

File: registries/contracts/multisigs/GnosisSafeSameAddressMultisig.sol

2: pragma solidity ^0.8.21;

Github: [2]

File: tokenomics/contracts/Depository.sol

2: pragma solidity ^0.8.20;

Github: [2]

File: tokenomics/contracts/Dispenser.sol

2: pragma solidity ^0.8.18;

Github: [2]

File: tokenomics/contracts/DonatorBlacklist.sol

2: pragma solidity ^0.8.18;

Github: [2]

File: tokenomics/contracts/GenericBondCalculator.sol

2: pragma solidity ^0.8.18;

Github: [2]

File: tokenomics/contracts/Tokenomics.sol

2: pragma solidity ^0.8.20;

Github: [2]

File: tokenomics/contracts/TokenomicsConstants.sol

2: pragma solidity ^0.8.20;

Github: [2]

File: tokenomics/contracts/TokenomicsProxy.sol

2: pragma solidity ^0.8.18;

Github: [2]

File: tokenomics/contracts/Treasury.sol

2: pragma solidity ^0.8.18;

Github: [2]

File: tokenomics/contracts/interfaces/IDonatorBlacklist.sol

2: pragma solidity ^0.8.18;

Github: [2]

File: tokenomics/contracts/interfaces/IErrorsTokenomics.sol

2: pragma solidity ^0.8.18;

Github: [2]

File: tokenomics/contracts/interfaces/IGenericBondCalculator.sol

2: pragma solidity ^0.8.18;

Github: [2]

File: tokenomics/contracts/interfaces/IOLAS.sol

2: pragma solidity ^0.8.18;

Github: [2]

File: tokenomics/contracts/interfaces/IServiceRegistry.sol

2: pragma solidity ^0.8.18;

Github: [2]

File: tokenomics/contracts/interfaces/IToken.sol

2: pragma solidity ^0.8.18;

Github: [2]

File: tokenomics/contracts/interfaces/ITokenomics.sol

2: pragma solidity ^0.8.18;

Github: [2]

File: tokenomics/contracts/interfaces/ITreasury.sol

2: pragma solidity ^0.8.18;

Github: [2]

File: tokenomics/contracts/interfaces/IUniswapV2Pair.sol

2: pragma solidity ^0.8.18;

Github: [2]

File: tokenomics/contracts/interfaces/IVotingEscrow.sol

2: pragma solidity ^0.8.18;

Github: [2]

[L-19] Some functions do not work correctly with fee-on-transfer tokens

Some tokens take a transfer fee (e.g. STA, PAXG), some do not currently charge a fee but may do so in the future (e.g. USDT, USDC).

Should a fee-on-transfer token be added as an asset and deposited, it could be abused, as the accounting is wrong. In the current implementation the following function calls do not work well with fee-on-transfer tokens as the amount variable is the pre-fee amount, including the fee, whereas the final balance do not include the fee anymore.

There are 8 instances of this issue:

File: governance/contracts/bridges/FxERC20ChildTunnel.sol

79:         bool success = IERC20(childToken).transfer(to, amount);

102:         bool success = IERC20(childToken).transferFrom(msg.sender, address(this), amount);

Github: [79, 102]

File: governance/contracts/bridges/FxERC20RootTunnel.sol

98:         bool success = IERC20(rootToken).transferFrom(msg.sender, address(this), amount);

Github: [98]

File: governance/contracts/veOLAS.sol

364:             IERC20(token).transferFrom(msg.sender, address(this), amount);

534:         IERC20(token).transfer(msg.sender, amount);

Github: [364, 534]

File: tokenomics/contracts/Depository.sol

390:         IToken(olas).transfer(msg.sender, payout);

Github: [390]

File: tokenomics/contracts/Treasury.sol

235:         bool success = IToken(token).transferFrom(account, address(this), tokenAmount);

362:                 success = IToken(token).transfer(to, tokenAmount);

Github: [235, 362]

[L-20] Some tokens may revert when large transfers are made

Tokens such as COMP or UNI will revert when an address' balance reaches type(uint96).max. Ensure that the calls below can be broken up into smaller batches if necessary.

There are 8 instances of this issue:

File: governance/contracts/bridges/FxERC20ChildTunnel.sol

79:         bool success = IERC20(childToken).transfer(to, amount);

102:         bool success = IERC20(childToken).transferFrom(msg.sender, address(this), amount);

Github: [79, 102]

File: governance/contracts/bridges/FxERC20RootTunnel.sol

98:         bool success = IERC20(rootToken).transferFrom(msg.sender, address(this), amount);

Github: [98]

File: governance/contracts/veOLAS.sol

364:             IERC20(token).transferFrom(msg.sender, address(this), amount);

534:         IERC20(token).transfer(msg.sender, amount);

Github: [364, 534]

File: tokenomics/contracts/Depository.sol

390:         IToken(olas).transfer(msg.sender, payout);

Github: [390]

File: tokenomics/contracts/Treasury.sol

235:         bool success = IToken(token).transferFrom(account, address(this), tokenAmount);

362:                 success = IToken(token).transfer(to, tokenAmount);

Github: [235, 362]

[L-21] Some tokens may revert when zero value transfers are made

Despite the fact that EIP-20 states that zero-value transfers must be accepted, some tokens, such as LEND, will revert if this is attempted, which may cause transactions that involve other tokens (such as batch operations) to fully revert. Consider skipping the transfer if the amount is zero, which will also save gas.

There are 8 instances of this issue:

File: governance/contracts/bridges/FxERC20ChildTunnel.sol

79:         bool success = IERC20(childToken).transfer(to, amount);

102:         bool success = IERC20(childToken).transferFrom(msg.sender, address(this), amount);

Github: [79, 102]

File: governance/contracts/bridges/FxERC20RootTunnel.sol

98:         bool success = IERC20(rootToken).transferFrom(msg.sender, address(this), amount);

Github: [98]

File: governance/contracts/veOLAS.sol

364:             IERC20(token).transferFrom(msg.sender, address(this), amount);

534:         IERC20(token).transfer(msg.sender, amount);

Github: [364, 534]

File: tokenomics/contracts/Depository.sol

390:         IToken(olas).transfer(msg.sender, payout);

Github: [390]

File: tokenomics/contracts/Treasury.sol

235:         bool success = IToken(token).transferFrom(account, address(this), tokenAmount);

362:                 success = IToken(token).transfer(to, tokenAmount);

Github: [235, 362]

[L-22] Tokens may be minted to `address(0)`

There are 2 instances of this issue:

File: governance/contracts/OLAS.sol

75:     function mint(address account, uint256 amount) external {
            // Access control
            if (msg.sender != minter) {
                revert ManagerOnly(msg.sender, minter);
            }
    
            // Check the inflation schedule and mint
            if (inflationControl(amount)) {
                _mint(account, amount);
            }
        }

Github: [75]

File: governance/contracts/bridges/BridgedERC20.sol

48:     function mint(address account, uint256 amount) external {
            // Only the contract owner is allowed to mint
            if (msg.sender != owner) {
                revert OwnerOnly(msg.sender, owner);
            }
            
            _mint(account, amount);
        }

Github: [48]

[L-23] Unsafe downcast

When a type is downcast to a smaller type, the higher order bits are truncated, effectively applying a modulo to the original value. Without any other checks, this wrapping will lead to unexpected behavior and bugs.

There are 90 instances (click to show):

File: governance/contracts/multisigs/GuardCM.sol

/// @audit uint256 -> uint160
364:             address bridgeMediatorL2 = address(uint160(bridgeMediatorL2ChainId));

/// @audit uint256 -> uint160
603:         bridgeMediatorL2 = address(uint160(bridgeMediatorL2ChainId));

Github: [364, 603]

File: governance/contracts/veOLAS.sol

/// @audit uint256 -> uint64
139:         mapSupplyPoints[0] = PointVoting(0, 0, uint64(block.timestamp), uint64(block.number), 0);

/// @audit uint256 -> uint64
139:         mapSupplyPoints[0] = PointVoting(0, 0, uint64(block.timestamp), uint64(block.number), 0);

/// @audit uint256 -> uint64
190:                 uOld.bias = uOld.slope * int128(uint128(oldLocked.endTime - uint64(block.timestamp)));

/// @audit uint256 -> uint64
194:                 uNew.bias = uNew.slope * int128(uint128(newLocked.endTime - uint64(block.timestamp)));

/// @audit uint256 -> uint64
215:             lastPoint = PointVoting(0, 0, uint64(block.timestamp), uint64(block.number), 0);

/// @audit uint256 -> uint64
215:             lastPoint = PointVoting(0, 0, uint64(block.timestamp), uint64(block.number), 0);

/// @audit uint256 -> uint64
241:                     tStep = uint64(block.timestamp);

/// @audit uint256 -> uint64
258:                 lastPoint.blockNumber = initialPoint.blockNumber + uint64((block_slope * uint256(tStep - initialPoint.ts)) / 1e18);

/// @audit uint256 -> uint64
266:                     lastPoint.blockNumber = uint64(block.number);

/// @audit uint256 -> uint64
312:             uNew.ts = uint64(block.timestamp);

/// @audit uint256 -> uint64
313:             uNew.blockNumber = uint64(block.number);

/// @audit uint256 -> uint128
321:         _checkpoint(address(0), LockedBalance(0, 0), LockedBalance(0, 0), uint128(supply));

/// @audit uint256 -> uint128
350:             lockedBalance.amount += uint128(amount);

/// @audit uint256 -> uint64
353:             lockedBalance.endTime = uint64(unlockTime);

/// @audit uint256 -> uint128
361:         _checkpoint(account, oldLocked, lockedBalance, uint128(supplyAfter));

/// @audit uint256 -> uint128
528:         _checkpoint(msg.sender, lockedBalance, LockedBalance(0, 0), uint128(supplyAfter));

/// @audit uint256 -> uint64
634:         return _balanceOfLocked(account, uint64(block.timestamp));

/// @audit uint256 -> uint64
680:         uPoint.bias -= uPoint.slope * int128(int64(uint64(blockTime)) - int64(uPoint.ts));

/// @audit uint256 -> uint64
740:         return _supplyLockedAt(lastPoint, uint64(ts));

/// @audit uint256 -> uint64
755:         return _supplyLockedAt(sPoint, uint64(blockTime));

Github: [139, 139, 190, 194, 215, 215, 241, 258, 266, 312, 313, 321, 350, 353, 361, 528, 634, 680, 740, 755]

File: registries/contracts/AgentRegistry.sol

/// @audit uint256 -> uint32
38:         uint32 componentTotalSupply = uint32(IRegistry(componentRegistry).totalSupply());

Github: [38]

File: registries/contracts/UnitRegistry.sol

/// @audit uint256 -> uint32
75:         _checkDependencies(dependencies, uint32(unitId));

/// @audit uint256 -> uint32
102:             addSubComponentIds[numSubComponents] = uint32(unitId);

/// @audit uint256 -> uint32
203:         uint32 numUnits = uint32(unitIds.length);

/// @audit uint256 -> uint32
214:             numComponents[i] = uint32(components[i].length);

Github: [75, 102, 203, 214]

File: tokenomics/contracts/Depository.sol

/// @audit uint256 -> uint160
232:         mapBondProducts[productId] = Product(uint160(priceLP), uint32(vesting), token, uint96(supply));

/// @audit uint256 -> uint32
232:         mapBondProducts[productId] = Product(uint160(priceLP), uint32(vesting), token, uint96(supply));

/// @audit uint256 -> uint96
232:         mapBondProducts[productId] = Product(uint160(priceLP), uint32(vesting), token, uint96(supply));

/// @audit uint256 -> uint32
234:         productCounter = uint32(productId + 1);

/// @audit uint256 -> uint96
329:         product.supply = uint96(supply);

/// @audit uint256 -> uint96
333:         mapUserBonds[bondId] = Bond(msg.sender, uint96(payout), uint32(maturity), uint32(productId));

/// @audit uint256 -> uint32
333:         mapUserBonds[bondId] = Bond(msg.sender, uint96(payout), uint32(maturity), uint32(productId));

/// @audit uint256 -> uint32
333:         mapUserBonds[bondId] = Bond(msg.sender, uint96(payout), uint32(maturity), uint32(productId));

/// @audit uint256 -> uint32
334:         bondCounter = uint32(bondId + 1);

Github: [232, 232, 232, 234, 329, 333, 333, 333, 334]

File: tokenomics/contracts/Tokenomics.sol

/// @audit uint256 -> uint32
296:         if (uint32(_epochLen) < MIN_EPOCH_LENGTH) {

/// @audit uint256 -> uint32
301:         if (uint32(_epochLen) > ONE_YEAR) {

/// @audit uint256 -> uint32
311:         epochLen = uint32(_epochLen);

/// @audit uint256 -> uint32
325:         uint256 zeroYearSecondsLeft = uint32(_timeLaunch + ONE_YEAR - block.timestamp);

/// @audit uint256 -> uint96
330:         inflationPerSecond = uint96(_inflationPerSecond);

/// @audit uint256 -> uint32
331:         timeLaunch = uint32(_timeLaunch);

/// @audit uint256 -> uint32
334:         mapEpochTokenomics[0].epochPoint.endTime = uint32(block.timestamp);

/// @audit uint256 -> uint8
361:         tp.epochPoint.maxBondFraction = uint8(_maxBondFraction);

/// @audit uint256 -> uint96
368:         maxBond = uint96(_maxBond);

/// @audit uint256 -> uint96
369:         effectiveBond = uint96(_maxBond);

/// @audit uint256 -> uint72
511:         if (uint72(_devsPerCapital) > MIN_PARAM_VALUE) {

/// @audit uint256 -> uint72
512:             devsPerCapital = uint72(_devsPerCapital);

/// @audit uint256 -> uint72
519:         if (uint72(_codePerDev) > MIN_PARAM_VALUE) {

/// @audit uint256 -> uint72
520:             codePerDev = uint72(_codePerDev);

/// @audit uint256 -> uint64
530:             epsilonRate = uint64(_epsilonRate);

/// @audit uint256 -> uint32
536:         if (uint32(_epochLen) >= MIN_EPOCH_LENGTH && uint32(_epochLen) <= ONE_YEAR) {

/// @audit uint256 -> uint32
536:         if (uint32(_epochLen) >= MIN_EPOCH_LENGTH && uint32(_epochLen) <= ONE_YEAR) {

/// @audit uint256 -> uint32
537:             nextEpochLen = uint32(_epochLen);

/// @audit uint256 -> uint96
543:         if (uint96(_veOLASThreshold) > 0) {

/// @audit uint256 -> uint96
544:             nextVeOLASThreshold = uint96(_veOLASThreshold);

/// @audit uint256 -> uint8
589:         tp.unitPoints[0].rewardUnitFraction = uint8(_rewardComponentFraction);

/// @audit uint256 -> uint8
590:         tp.unitPoints[1].rewardUnitFraction = uint8(_rewardAgentFraction);

/// @audit uint256 -> uint8
592:         tp.epochPoint.rewardTreasuryFraction = uint8(100 - _rewardComponentFraction - _rewardAgentFraction);

/// @audit uint256 -> uint8
594:         tp.epochPoint.maxBondFraction = uint8(_maxBondFraction);

/// @audit uint256 -> uint8
595:         tp.unitPoints[0].topUpUnitFraction = uint8(_topUpComponentFraction);

/// @audit uint256 -> uint8
596:         tp.unitPoints[1].topUpUnitFraction = uint8(_topUpAgentFraction);

/// @audit uint256 -> uint96
621:             effectiveBond = uint96(eBond);

/// @audit uint256 -> uint96
642:         effectiveBond = uint96(eBond);

/// @audit uint256 -> uint96
660:             mapUnitIncentives[unitType][unitId].reward = uint96(totalIncentives);

/// @audit uint256 -> uint96
676:             mapUnitIncentives[unitType][unitId].topUp = uint96(totalIncentives);

/// @audit uint256 -> uint96
726:                     uint96 amount = uint96(amounts[i] / numServiceUnits);

/// @audit uint256 -> uint32
733:                             mapUnitIncentives[unitType][serviceUnitIds[j]].lastEpoch = uint32(curEpoch);

/// @audit uint256 -> uint32
741:                             mapUnitIncentives[unitType][serviceUnitIds[j]].lastEpoch = uint32(curEpoch);

/// @audit uint256 -> uint96
818:         mapEpochTokenomics[curEpoch].epochPoint.totalDonationsETH = uint96(donationETH);

/// @audit uint256 -> uint32
824:         lastDonationBlockNumber = uint32(block.number);

/// @audit uint256 -> uint96
939:             inflationPerSecond = uint96(curInflationPerSecond);

/// @audit uint256 -> uint8
940:             currentYear = uint8(numYears);

/// @audit uint256 -> uint96
950:         tp.epochPoint.totalTopUpsOLAS = uint96(inflationPerEpoch);

/// @audit uint256 -> uint96
966:             effectiveBond = uint96(incentives[4]);

/// @audit uint256 -> uint32
991:                 epochLen = uint32(curEpochLen);

/// @audit uint256 -> uint32
1005:         tp.epochPoint.endTime = uint32(block.timestamp);

/// @audit uint256 -> uint96
1025:             maxBond = uint96(curMaxBond);

/// @audit uint256 -> uint96
1032:             maxBond = uint96(curMaxBond);

/// @audit uint256 -> uint96
1038:         effectiveBond = uint96(curMaxBond);

/// @audit uint256 -> uint64
1044:             nextEpochPoint.epochPoint.idf = uint64(idf);

/// @audit uint256 -> uint32
1067:             epochCounter = uint32(eCounter + 1);

Github: [296, 301, 311, 325, 330, 331, 334, 361, 368, 369, 511, 512, 519, 520, 530, 536, 536, 537, 543, 544, 589, 590, 592, 594, 595, 596, 621, 642, 660, 676, 726, 733, 741, 818, 824, 939, 940, 950, 966, 991, 1005, 1025, 1032, 1038, 1044, 1067]

File: tokenomics/contracts/Treasury.sol

/// @audit uint256 -> uint96
112:         ETHOwned = uint96(address(this).balance);

/// @audit uint256 -> uint96
131:         ETHOwned = uint96(amount);

/// @audit uint256 -> uint96
198:         minAcceptedETH = uint96(_minAcceptedETH);

/// @audit uint256 -> uint96
294:         ETHFromServices = uint96(donationETH);

/// @audit uint256 -> uint96
336:                 ETHOwned = uint96(amountOwned);

/// @audit uint256 -> uint96
404:             ETHFromServices = uint96(amountETHFromServices);

/// @audit uint256 -> uint96
450:                 ETHOwned = uint96(amountETHOwned);

/// @audit uint256 -> uint96
451:                 ETHFromServices = uint96(amountETHFromServices);

Github: [112, 131, 198, 294, 336, 404, 450, 451]

[L-24] Unsafe solidity low-level call can cause gas grief attack

Using the low-level calls of a solidity address can leave the contract open to gas grief attacks. These attacks occur when the called contract returns a large amount of data. So when calling an external contract, it is necessary to check the length of the return data before reading/copying it (using returndatasize()).

There are 4 instances of this issue:

File: governance/contracts/bridges/HomeMediator.sol

160:             (bool success, ) = target.call{value: value}(payload);

Github: [160]

File: registries/contracts/multisigs/GnosisSafeSameAddressMultisig.sol

118:             (bool success, ) = multisig.call(payload);

Github: [118]

File: tokenomics/contracts/Treasury.sol

339:                 (success, ) = to.call{value: tokenAmount}("");

406:             (success, ) = account.call{value: accountRewards}("");

Github: [339, 406]

[L-25] Consider using `ERC721A` instead of `ERC721`

ERC721A is an implementation of IERC721 with significant gas savings for minting multiple NFTs in a single transaction.

There is one instance of this issue:

File: registries/contracts/GenericRegistry.sol

9: abstract contract GenericRegistry is IErrorsRegistries, ERC721 {

Github: [9]

[L-26] Using zero as a parameter

Taking 0 as a valid argument in Solidity without checks can lead to severe security issues. A historical example is the infamous 0x0 address bug where numerous tokens were lost. This happens because 0 can be interpreted as an uninitialized address, leading to transfers to the 0x0 address, effectively burning tokens. Moreover, 0 as a denominator in division operations would cause a runtime exception. It's also often indicative of a logical error in the caller's code. It's important to always validate input and handle edge cases like 0 appropriately. Use require() statements to enforce conditions and provide clear error messages to facilitate debugging and safer code.

There are 16 instances (click to show):

File: governance/contracts/veOLAS.sol

139:         mapSupplyPoints[0] = PointVoting(0, 0, uint64(block.timestamp), uint64(block.number), 0);

215:             lastPoint = PointVoting(0, 0, uint64(block.timestamp), uint64(block.number), 0);

321:         _checkpoint(address(0), LockedBalance(0, 0), LockedBalance(0, 0), uint128(supply));

321:         _checkpoint(address(0), LockedBalance(0, 0), LockedBalance(0, 0), uint128(supply));

321:         _checkpoint(address(0), LockedBalance(0, 0), LockedBalance(0, 0), uint128(supply));

396:         _depositFor(account, amount, 0, lockedBalance, DepositType.DEPOSIT_FOR_TYPE);

478:         _depositFor(msg.sender, amount, 0, lockedBalance, DepositType.INCREASE_LOCK_AMOUNT);

506:         _depositFor(msg.sender, 0, unlockTime, lockedBalance, DepositType.INCREASE_UNLOCK_TIME);

517:         mapLockedBalances[msg.sender] = LockedBalance(0, 0);

528:         _checkpoint(msg.sender, lockedBalance, LockedBalance(0, 0), uint128(supplyAfter));

650:         (point, minPointNumber) = _findPointByBlock(blockNumber, address(0));

728:         (PointVoting memory sPoint, ) = _findPointByBlock(blockNumber, address(0));

Github: [139, 215, 321, 321, 321, 396, 478, 506, 517, 528, 650, 728]

File: governance/contracts/wveOLAS.sol

213:         PointVoting memory uPoint = getUserPoint(account, 0);

233:         PointVoting memory uPoint = getUserPoint(account, 0);

Github: [213, 233]

File: tokenomics/contracts/Tokenomics.sol

329:         uint256 _inflationPerSecond = getInflationForYear(0) / zeroYearSecondsLeft;

Github: [329]

File: tokenomics/contracts/Treasury.sol

408:                 revert TransferFailed(address(0), address(this), account, accountRewards);

Github: [408]

[L-27] Vulnerable versions of packages are being used

This project is using specific package versions which are vulnerable to the specific CVEs listed below. Consider switching to more recent versions of these packages that don't have these vulnerabilities.

CVE-2023-40014 - MEDIUM - (openzeppelin-solidity >=4.0.0 <4.9.3): OpenZeppelin Contracts is a library for secure smart contract development. Starting in version 4.0.0 and prior to version 4.9.3, contracts using ERC2771Context along with a custom trusted forwarder may see _msgSender return address(0) in calls that originate from the forwarder with calldata shorter than 20 bytes. This combination of circumstances does not appear to be common, in particular it is not the case for MinimalForwarder from OpenZeppelin Contracts, or any deployed forwarder the team is aware of, given that the signer address is appended to all calls that originate from these forwarders. The problem has been patched in v4.9.3.
CVE-2023-34459 - MEDIUM - (openzeppelin-solidity >=4.7.0 <4.9.2): OpenZeppelin Contracts is a library for smart contract development. Starting in version 4.7.0 and prior to version 4.9.2, when the verifyMultiProof, verifyMultiProofCalldata, procesprocessMultiProof, or processMultiProofCalldat functions are in use, it is possible to construct merkle trees that allow forging a valid multiproof for an arbitrary set of leaves. A contract may be vulnerable if it uses multiproofs for verification and the merkle tree that is processed includes a node with value 0 at depth 1 (just under the root). This could happen inadvertedly for balanced trees with 3 leaves or less, if the leaves are not hashed. This could happen deliberately if a malicious tree builder includes such a node in the tree. A contract is not vulnerable if it uses single-leaf proving (verify, verifyCalldata, processProof, or processProofCalldata), or if it uses multiproofs with a known tree that has hashed leaves. Standard merkle trees produced or validated with the @openzeppelin/merkle-tree library are safe. The problem has been patched in version 4.9.2. Some workarounds are available. For those using multiproofs: When constructing merkle trees hash the leaves and do not insert empty nodes in your trees. Using the @openzeppelin/merkle-tree package eliminates this issue. Do not accept user-provided merkle roots without reconstructing at least the first level of the tree. Verify the merkle tree structure by reconstructing it from the leaves.

There is one instance of this issue:

Global finding

Github: [Global]

[L-28] Missing zero address check in initializer

There is one instance of this issue:

File: tokenomics/contracts/Tokenomics.sol

/// @audit missing zero check for `_donatorBlacklist`
264:     function initializeTokenomics(
             address _olas,
             address _treasury,
             address _depository,
             address _dispenser,
             address _ve,
             uint256 _epochLen,
             address _componentRegistry,
             address _agentRegistry,
             address _serviceRegistry,
             address _donatorBlacklist
         ) external
         {

Github: [264]

[L-29] `tokenURI()` does not follow EIP-721

The EIP-721 states that tokenURI() should "Throws if _tokenId is not a valid NFT", which the code below does not do. If the NFT has not yet been minted, tokenURI() should revert.

There is one instance of this issue:

File: registries/contracts/GenericRegistry.sol

135:     function tokenURI(uint256 unitId) public view virtual override returns (string memory) {

Github: [135]

Non Critical Issues

[NC-1] Assembly blocks should have extensive comments

Assembly blocks take a lot more time to audit than normal Solidity code, and often have gotchas and side-effects that the Solidity versions of the same code do not. Consider adding more comments explaining what is being done in every step of the assembly code, and describe why assembly is being used instead of Solidity.

There are 10 instances of this issue:

File: governance/contracts/bridges/FxGovernorTunnel.sol

130:             assembly {

Github: [130]

File: governance/contracts/bridges/HomeMediator.sol

130:             assembly {

Github: [130]

File: governance/contracts/multisigs/GuardCM.sol

216:             assembly {

Github: [216]

File: registries/contracts/multisigs/GnosisSafeMultisig.sol

57:             assembly {

Github: [57]

File: registries/contracts/multisigs/GnosisSafeSameAddressMultisig.sol

98:         assembly {

Github: [98]

File: tokenomics/contracts/Tokenomics.sol

375:         assembly {

396:         assembly {

883:         assembly {

Github: [375, 396, 883]

File: tokenomics/contracts/TokenomicsProxy.sol

44:         assembly {

56:         assembly {

Github: [44, 56]

[NC-2] `abi.encodePacked()` should be replaced with `bytes.concat()`

Solidity version 0.8.4 introduces bytes.concat(), which can be used to replace abi.encodePacked() on bytes/strings. It can make the intended operation clearer, leading to less reviewer confusion.

There is one instance of this issue:

File: registries/contracts/GenericRegistry.sol

139:         return string(abi.encodePacked(baseURI, CID_PREFIX, _toHex16(bytes16(unitHash)),

Github: [139]

[NC-3] Add inline comments for unnamed variables

function foo(address x, address) -> function foo(address x, address /* y */)

There are 11 instances (click to show):

File: governance/contracts/multisigs/GuardCM.sol

387:     function checkTransaction(
             address to,
             uint256,
             bytes memory data,
             Enum.Operation operation,
             uint256,
             uint256,
             uint256,
             address,
             address payable,
             bytes memory,
             address
         ) external {

572:     function checkAfterExecution(bytes32, bool) external {}

Github: [387, 572]

File: governance/contracts/wveOLAS.sol

297:     function transfer(address, uint256) external returns (bool) {

302:     function approve(address, uint256) external returns (bool) {

307:     function transferFrom(address, address, uint256) external returns (bool) {

312:     function allowance(address, address) external view returns (uint256) {

317:     function delegates(address) external view returns (address) {

322:     function delegate(address) external
         {

328:     function delegateBySig(address, uint256, uint256, uint8, bytes32, bytes32) external
         {

Github: [297, 302, 307, 312, 317, 322, 328]

File: registries/contracts/AgentRegistry.sol

31:     function _checkDependencies(uint32[] memory dependencies, uint32) internal virtual override {

Github: [31]

File: registries/contracts/ComponentRegistry.sol

41:     function _getSubComponents(UnitType, uint32 componentId) internal view virtual override
            returns (uint32[] memory subComponentIds)
        {

Github: [41]

[NC-4] Avoid the use of sensitive terms

Use alternative variants, e.g. allowlist/denylist instead of whitelist/blacklist

There are 44 instances (click to show):

File: registries/contracts/interfaces/IErrorsRegistries.sol

93:     /// @dev Multisig is not whitelisted.

Github: [93]

File: registries/contracts/multisigs/GnosisSafeSameAddressMultisig.sol

21: /// @dev Multisig proxy bytecode is not whitelisted.

Github: [21]

File: tokenomics/contracts/DonatorBlacklist.sol

17: /// @title DonatorBlacklist - Smart contract for donator address blacklisting

20: contract DonatorBlacklist {

22:     event DonatorBlacklistStatus(address indexed account, bool status);

26:     // Mapping account address => blacklisting status

27:     mapping(address => bool) public mapBlacklistedDonators;

29:     /// @dev DonatorBlacklist constructor.

51:     /// @dev Controls donators blacklisting statuses.

52:     /// @notice Donator is considered blacklisted if its status is set to true.

54:     /// @param statuses Set blacklisting statuses.

72:             // Set the account blacklisting status

73:             mapBlacklistedDonators[accounts[i]] = statuses[i];

74:             emit DonatorBlacklistStatus(accounts[i], statuses[i]);

79:     /// @dev Gets account blacklisting status.

81:     /// @return status Blacklisting status.

82:     function isDonatorBlacklisted(address account) external view returns (bool status) {

83:         status = mapBlacklistedDonators[account];

Github: [17, 20, 22, 26, 27, 29, 51, 52, 54, 72, 73, 74, 79, 81, 82, 83]

File: tokenomics/contracts/Tokenomics.sol

5: import "./interfaces/IDonatorBlacklist.sol";

135:     event DonatorBlacklistUpdated(address indexed blacklist);

210:     // Blacklist contract address

211:     address public donatorBlacklist;

247:     /// @param _donatorBlacklist DonatorBlacklist address.

259:     /// #if_succeeds {:msg "donatorBlacklist assignment"} donatorBlacklist == _donatorBlacklist;

274:         address _donatorBlacklist

315:         donatorBlacklist = _donatorBlacklist;

471:     /// @dev Changes donator blacklist contract address.

472:     /// @notice DonatorBlacklist contract can be disabled by setting its address to zero.

473:     /// @param _donatorBlacklist DonatorBlacklist contract address.

474:     function changeDonatorBlacklist(address _donatorBlacklist) external {

480:         donatorBlacklist = _donatorBlacklist;

481:         emit DonatorBlacklistUpdated(_donatorBlacklist);

799:         // Check if the donator blacklist is enabled, and the status of the donator address

800:         address bList = donatorBlacklist;

801:         if (bList != address(0) && IDonatorBlacklist(bList).isDonatorBlacklisted(donator)) {

802:             revert DonatorBlacklisted(donator);

Github: [5, 135, 210, 211, 247, 259, 274, 315, 471, 472, 473, 474, 480, 481, 799, 800, 801, 802]

File: tokenomics/contracts/interfaces/IDonatorBlacklist.sol

4: /// @dev DonatorBlacklist interface.

5: interface IDonatorBlacklist {

6:     /// @dev Gets account blacklisting status.

8:     /// @return status Blacklisting status.

9:     function isDonatorBlacklisted(address account) external view returns (bool status);

Github: [4, 5, 6, 8, 9]

File: tokenomics/contracts/interfaces/IErrorsTokenomics.sol

43:     /// @dev Token is disabled or not whitelisted.

114:     /// @dev The donator address is blacklisted.

116:     error DonatorBlacklisted(address account);

Github: [43, 114, 116]

[NC-5] The terminating element, `);`, should be placed on the final line by itself

It is recommended by the Solidity Style Guide.

There are 3 instances of this issue:

File: registries/contracts/multisigs/GnosisSafeMultisig.sol

102:         bytes memory safeParams = abi.encodeWithSelector(GNOSIS_SAFE_SETUP_SELECTOR, owners, threshold,
                 to, payload, fallbackHandler, paymentToken, payment, paymentReceiver);

Github: [102]

File: tokenomics/contracts/Tokenomics.sol

551:         emit TokenomicsParametersUpdateRequested(epochCounter + 1, _devsPerCapital, _codePerDev, _epsilonRate, _epochLen,
                 _veOLASThreshold);

600:         emit IncentiveFractionsUpdateRequested(eCounter, _rewardComponentFraction, _rewardAgentFraction,
                 _maxBondFraction, _topUpComponentFraction, _topUpAgentFraction);

Github: [551, 600]

[NC-6] Multiple `address`/ID mappings can be combined into a single `mapping` of an `address`/ID to a `struct`, for readability

Well-organized data structures make code reviews easier, which may lead to fewer bugs. Consider combining related mappings into mappings to structs, so it's clear what data is related

There are 2 instances of this issue:

File: tokenomics/contracts/Tokenomics.sol

225:     mapping(uint256 => mapping(uint256 => bool)) public mapNewUnits;

229:     mapping(uint256 => mapping(uint256 => IncentiveBalances)) public mapUnitIncentives;

Github: [225, 229]

[NC-7] Complex casting

Consider whether the number of casts is really necessary, or whether using a different type would be more appropriate. Alternatively, add comments to explain in detail why the casts are necessary, and any implicit reasons why the cast does not introduce an overflow.

There are 16 instances (click to show):

File: governance/contracts/multisigs/GuardCM.sol

192:         uint256 targetSelectorChainId = uint256(uint160(target));

194:         targetSelectorChainId |= uint256(uint32(bytes4(data))) << 160;

476:             uint256 targetSelectorChainId = uint256(uint160(targets[i]));

478:             targetSelectorChainId |= uint256(uint32(selectors[i])) << 160;

525:             uint256 bridgeMediatorL2ChainId = uint256(uint160(bridgeMediatorL2s[i]));

584:         uint256 targetSelectorChainId = uint256(uint160(target));

586:         targetSelectorChainId |= uint256(uint32(selector)) << 160;

Github: [192, 194, 476, 478, 525, 584, 586]

File: governance/contracts/veOLAS.sol

190:                 uOld.bias = uOld.slope * int128(uint128(oldLocked.endTime - uint64(block.timestamp)));

194:                 uNew.bias = uNew.slope * int128(uint128(newLocked.endTime - uint64(block.timestamp)));

245:                 lastPoint.bias -= lastPoint.slope * int128(int64(tStep - lastCheckpoint));

597:             uPoint.bias -= uPoint.slope * int128(int64(ts) - int64(uPoint.ts));

599:                 vBalance = uint256(int256(uPoint.bias));

680:         uPoint.bias -= uPoint.slope * int128(int64(uint64(blockTime)) - int64(uPoint.ts));

682:             balance = uint256(uint128(uPoint.bias));

704:             lastPoint.bias -= lastPoint.slope * int128(int64(tStep) - int64(lastPoint.ts));

713:             vSupply = uint256(uint128(lastPoint.bias));

Github: [190, 194, 245, 597, 599, 680, 682, 704, 713]

[NC-8] Consider adding a block/deny-list

Doing so will significantly increase centralization, but will help to prevent hackers from using stolen tokens.

There are 27 instances (click to show):

File: governance/contracts/GovernorOLAS.sol

15: contract GovernorOLAS is Governor, GovernorSettings, GovernorCompatibilityBravo, GovernorVotes, GovernorVotesQuorumFraction, GovernorTimelockControl {

Github: [15]

File: governance/contracts/OLAS.sol

17: contract OLAS is ERC20 {

Github: [17]

File: governance/contracts/Timelock.sol

9: contract Timelock is TimelockController {

Github: [9]

File: governance/contracts/bridges/BridgedERC20.sol

18: contract BridgedERC20 is ERC20 {

Github: [18]

File: governance/contracts/bridges/FxERC20ChildTunnel.sol

24: contract FxERC20ChildTunnel is FxBaseChildTunnel {

Github: [24]

File: governance/contracts/bridges/FxERC20RootTunnel.sol

24: contract FxERC20RootTunnel is FxBaseRootTunnel {

Github: [24]

File: governance/contracts/bridges/FxGovernorTunnel.sol

46: contract FxGovernorTunnel is IFxMessageProcessor {

Github: [46]

File: governance/contracts/bridges/HomeMediator.sol

46: contract HomeMediator {

Github: [46]

File: governance/contracts/multisigs/GuardCM.sol

88: contract GuardCM {

Github: [88]

File: governance/contracts/veOLAS.sol

86: contract veOLAS is IErrors, IVotes, IERC20, IERC165 {

Github: [86]

File: governance/contracts/wveOLAS.sol

130: contract wveOLAS {

Github: [130]

File: registries/contracts/AgentRegistry.sol

9: contract AgentRegistry is UnitRegistry {

Github: [9]

File: registries/contracts/ComponentRegistry.sol

8: contract ComponentRegistry is UnitRegistry {

Github: [8]

File: registries/contracts/GenericManager.sol

8: abstract contract GenericManager is IErrorsRegistries {

Github: [8]

File: registries/contracts/GenericRegistry.sol

9: abstract contract GenericRegistry is IErrorsRegistries, ERC721 {

Github: [9]

File: registries/contracts/RegistriesManager.sol

9: contract RegistriesManager is GenericManager {

Github: [9]

File: registries/contracts/UnitRegistry.sol

8: abstract contract UnitRegistry is GenericRegistry {

Github: [8]

File: registries/contracts/multisigs/GnosisSafeMultisig.sol

24: contract GnosisSafeMultisig {

Github: [24]

File: registries/contracts/multisigs/GnosisSafeSameAddressMultisig.sol

50: contract GnosisSafeSameAddressMultisig {

Github: [50]

File: tokenomics/contracts/Depository.sol

62: contract Depository is IErrorsTokenomics {

Github: [62]

File: tokenomics/contracts/Dispenser.sol

11: contract Dispenser is IErrorsTokenomics {

Github: [11]

File: tokenomics/contracts/DonatorBlacklist.sol

20: contract DonatorBlacklist {

Github: [20]

File: tokenomics/contracts/GenericBondCalculator.sol

20: contract GenericBondCalculator {

Github: [20]

File: tokenomics/contracts/Tokenomics.sol

118: contract Tokenomics is TokenomicsConstants, IErrorsTokenomics {

Github: [118]

File: tokenomics/contracts/TokenomicsConstants.sol

9: abstract contract TokenomicsConstants {

Github: [9]

File: tokenomics/contracts/TokenomicsProxy.sol

26: contract TokenomicsProxy {

Github: [26]

File: tokenomics/contracts/Treasury.sol

39: contract Treasury is IErrorsTokenomics {

Github: [39]

[NC-9] Consider adding emergency-stop functionality

Consider adding Pausable to the following contracts so it's possible to stop them in case of an emergency.

There are 23 instances (click to show):

File: governance/contracts/GovernorOLAS.sol

15: contract GovernorOLAS is Governor, GovernorSettings, GovernorCompatibilityBravo, GovernorVotes, GovernorVotesQuorumFraction, GovernorTimelockControl {

Github: [15]

File: governance/contracts/OLAS.sol

17: contract OLAS is ERC20 {

Github: [17]

File: governance/contracts/Timelock.sol

9: contract Timelock is TimelockController {

Github: [9]

File: governance/contracts/bridges/BridgedERC20.sol

18: contract BridgedERC20 is ERC20 {

Github: [18]

File: governance/contracts/bridges/FxERC20ChildTunnel.sol

24: contract FxERC20ChildTunnel is FxBaseChildTunnel {

Github: [24]

File: governance/contracts/bridges/FxERC20RootTunnel.sol

24: contract FxERC20RootTunnel is FxBaseRootTunnel {

Github: [24]

File: governance/contracts/bridges/FxGovernorTunnel.sol

46: contract FxGovernorTunnel is IFxMessageProcessor {

Github: [46]

File: governance/contracts/bridges/HomeMediator.sol

46: contract HomeMediator {

Github: [46]

File: governance/contracts/multisigs/GuardCM.sol

88: contract GuardCM {

Github: [88]

File: governance/contracts/veOLAS.sol

86: contract veOLAS is IErrors, IVotes, IERC20, IERC165 {

Github: [86]

File: governance/contracts/wveOLAS.sol

130: contract wveOLAS {

Github: [130]

File: registries/contracts/AgentRegistry.sol

9: contract AgentRegistry is UnitRegistry {

Github: [9]

File: registries/contracts/ComponentRegistry.sol

8: contract ComponentRegistry is UnitRegistry {

Github: [8]

File: registries/contracts/RegistriesManager.sol

9: contract RegistriesManager is GenericManager {

Github: [9]

File: registries/contracts/multisigs/GnosisSafeMultisig.sol

24: contract GnosisSafeMultisig {

Github: [24]

File: registries/contracts/multisigs/GnosisSafeSameAddressMultisig.sol

50: contract GnosisSafeSameAddressMultisig {

Github: [50]

File: tokenomics/contracts/Depository.sol

62: contract Depository is IErrorsTokenomics {

Github: [62]

File: tokenomics/contracts/Dispenser.sol

11: contract Dispenser is IErrorsTokenomics {

Github: [11]

File: tokenomics/contracts/DonatorBlacklist.sol

20: contract DonatorBlacklist {

Github: [20]

File: tokenomics/contracts/GenericBondCalculator.sol

20: contract GenericBondCalculator {

Github: [20]

File: tokenomics/contracts/Tokenomics.sol

118: contract Tokenomics is TokenomicsConstants, IErrorsTokenomics {

Github: [118]

File: tokenomics/contracts/TokenomicsProxy.sol

26: contract TokenomicsProxy {

Github: [26]

File: tokenomics/contracts/Treasury.sol

39: contract Treasury is IErrorsTokenomics {

Github: [39]

[NC-10] Consider adding formal verification proofs

Formal verification is the act of proving or disproving the correctness of intended algorithms underlying a system with respect to a certain formal specification/property/invariant, using formal methods of mathematics.

Some tools that are currently available to perform these tests on smart contracts are SMTChecker and Certora Prover.

There is one instance of this issue:

Global finding

Github: [Global]

[NC-11] Consider bounding input array length

The functions below take in an unbounded array, and make function calls for entries in the array. While the function will revert if it eventually runs out of gas, it may be a nicer user experience to require() that the length of the array is below some reasonable maximum, so that the user doesn't have to use up a full transaction's gas only to see that the transaction reverts.

There are 2 instances of this issue:

File: registries/contracts/ComponentRegistry.sol

/// @audit consider length check for `dependencies`
29:         for (uint256 iDep = 0; iDep < dependencies.length; ++iDep) {

Github: [29]

File: tokenomics/contracts/Depository.sol

/// @audit consider length check for `bondIds`
357:         for (uint256 i = 0; i < bondIds.length; ++i) {

Github: [357]

[NC-12] Consider using descriptive `constant`s when passing zero as a function argument

Passing zero as a function argument can sometimes result in a security issue (e.g. passing zero as the slippage parameter). Consider using a constant variable with a descriptive name, so it's clear that the argument is intentionally being used, and for the right reasons.

There are 6 instances of this issue:

File: governance/contracts/veOLAS.sol

396:         _depositFor(account, amount, 0, lockedBalance, DepositType.DEPOSIT_FOR_TYPE);

478:         _depositFor(msg.sender, amount, 0, lockedBalance, DepositType.INCREASE_LOCK_AMOUNT);

506:         _depositFor(msg.sender, 0, unlockTime, lockedBalance, DepositType.INCREASE_UNLOCK_TIME);

Github: [396, 478, 506]

File: governance/contracts/wveOLAS.sol

213:         PointVoting memory uPoint = getUserPoint(account, 0);

233:         PointVoting memory uPoint = getUserPoint(account, 0);

Github: [213, 233]

File: tokenomics/contracts/Tokenomics.sol

329:         uint256 _inflationPerSecond = getInflationForYear(0) / zeroYearSecondsLeft;

Github: [329]

[NC-13] Constant redefined elsewhere

Consider defining in only one contract so that values cannot become out of sync when only one location is updated. A cheap way to store constants in a single location is to create an internal constant in a library. If the variable is a local cache of another contract's value, consider making the cache variable internal or private, which will require external users to query the contract with the source of truth, so that callers don't get out of sync.

There are 4 instances of this issue:

File: governance/contracts/bridges/FxGovernorTunnel.sol

/// @audit also seen in governance/contracts/bridges/HomeMediator.sol, registries/contracts/multisigs/GnosisSafeMultisig.sol, registries/contracts/multisigs/GnosisSafeSameAddressMultisig.sol
53:     uint256 public constant DEFAULT_DATA_LENGTH = 36;

Github: [53]

File: governance/contracts/veOLAS.sol

/// @audit also seen in governance/contracts/wveOLAS.sol
105:     uint8 public constant decimals = 18;

Github: [105]

File: registries/contracts/ComponentRegistry.sol

/// @audit also seen in registries/contracts/AgentRegistry.sol, tokenomics/contracts/Depository.sol, tokenomics/contracts/TokenomicsConstants.sol
10:     string public constant VERSION = "1.0.0";

Github: [10]

File: tokenomics/contracts/TokenomicsConstants.sol

/// @audit also seen in tokenomics/contracts/TokenomicsProxy.sol
14:     bytes32 public constant PROXY_TOKENOMICS = 0xbd5523e7c3b6a94aa0e3b24d1120addc2f95c7029e097b466b2bedc8d4b4362f;

Github: [14]

[NC-14] Constants should be put on the left side of comparisons

Putting constants on the left side of comparison statements is a best practice known as Yoda conditions. Although solidity's static typing system prevents accidental assignments within conditionals, adopting this practice can improve code readability and consistency, especially when working across multiple languages.

There are 98 instances (click to show):

File: governance/contracts/OLAS.sol

48:         if (newOwner == address(0)) {

63:         if (newMinter == address(0)) {

Github: [48, 63]

File: governance/contracts/bridges/BridgedERC20.sol

37:         if (newOwner == address(0)) {

Github: [37]

File: governance/contracts/bridges/FxERC20ChildTunnel.sol

39:         if (_fxChild == address(0) || _childToken == address(0) || _rootToken == address(0)) {

59:         if (to == address(0)) {

92:         if (amount == 0) {

Github: [39, 59, 92]

File: governance/contracts/bridges/FxERC20RootTunnel.sol

42:         if (_checkpointManager == address(0) || _fxRoot == address(0) || _childToken == address(0) ||

63:         if (to == address(0)) {

88:         if (amount == 0) {

Github: [42, 63, 88]

File: governance/contracts/bridges/FxGovernorTunnel.sol

64:         if (_fxChild == address(0) || _rootGovernor == address(0)) {

89:         if (newRootGovernor == address(0)) {

143:             if (target == address(0)) {

Github: [64, 89, 143]

File: governance/contracts/bridges/HomeMediator.sol

64:         if (_AMBContractProxyHome == address(0) || _foreignGovernor == address(0)) {

89:         if (newForeignGovernor == address(0)) {

143:             if (target == address(0)) {

Github: [64, 89, 143]

File: governance/contracts/multisigs/GuardCM.sol

144:         if (_timelock == address(0) || _multisig == address(0) || _governor == address(0)) {

160:         if (newGovernor == address(0)) {

176:         if (proposalId == 0) {

226:             if (target == address(0)) {

367:             if (bridgeMediatorL2 != address(0)) {

460:             if (targets[i] == address(0)) {

470:             if (chainIds[i] == 0) {

513:             if (bridgeMediatorL1s[i] == address(0) || bridgeMediatorL2s[i] == address(0)) {

Github: [144, 160, 176, 226, 367, 460, 470, 513]

File: governance/contracts/veOLAS.sol

185:         if (account != address(0)) {

278:         if (account != address(0)) {

293:         if (account != address(0)) {

379:         if (amount == 0) {

383:         if (lockedBalance.amount == 0) {

413:         if (account == address(0)) {

427:         if (amount == 0) {

461:         if (amount == 0) {

465:         if (lockedBalance.amount == 0) {

490:         if (lockedBalance.amount == 0) {

547:         if (account == address(0)) {

551:             if (maxPointNumber == 0) {

568:             if (account == address(0)) {

582:         if (account == address(0)) {

Github: [185, 278, 293, 379, 383, 413, 427, 461, 465, 490, 547, 551, 568, 582]

File: governance/contracts/wveOLAS.sol

147:         if (_ve == address(0) || _token == address(0)) {

Github: [147]

File: registries/contracts/AgentRegistry.sol

33:         if (dependencies.length == 0) {

Github: [33]

File: registries/contracts/GenericManager.sol

27:         if (newOwner == address(0)) {

Github: [27]

File: registries/contracts/GenericRegistry.sol

44:         if (newOwner == address(0)) {

60:         if (newManager == address(0)) {

85:         if (bytes(bURI).length == 0) {

Github: [44, 60, 85]

File: registries/contracts/UnitRegistry.sol

64:         if(unitOwner == address(0)) {

69:         if (unitHash == 0) {

139:         if (unitHash == 0) {

Github: [64, 69, 139]

File: tokenomics/contracts/Depository.sol

111:         if (_olas == address(0) || _tokenomics == address(0) || _treasury == address(0) || _bondCalculator == address(0)) {

130:         if (newOwner == address(0)) {

150:         if (_tokenomics != address(0)) {

155:         if (_treasury != address(0)) {

169:         if (_bondCalculator != address(0)) {

190:         if (priceLP == 0) {

200:         if (supply == 0) {

295:         if (tokenAmount == 0) {

304:         if (supply == 0) {

340:         if (supply == 0) {

363:             if (pay == 0 || !matured) {

384:         if (payout == 0) {

404:             if ((active && mapBondProducts[i].supply > 0) || (!active && mapBondProducts[i].supply == 0)) {

439:         if (account == address(0)) {

Github: [111, 130, 150, 155, 169, 190, 200, 295, 304, 340, 363, 384, 404, 439]

File: tokenomics/contracts/Dispenser.sol

36:         if (_tokenomics == address(0) || _treasury == address(0)) {

53:         if (newOwner == address(0)) {

71:         if (_tokenomics != address(0)) {

76:         if (_treasury != address(0)) {

Github: [36, 53, 71, 76]

File: tokenomics/contracts/DonatorBlacklist.sol

43:         if (newOwner == address(0)) {

69:             if (accounts[i] == address(0)) {

Github: [43, 69]

File: tokenomics/contracts/GenericBondCalculator.sol

31:         if (_olas == address(0) || _tokenomics == address(0)) {

Github: [31]

File: tokenomics/contracts/Tokenomics.sol

278:         if (owner != address(0)) {

283:         if (_olas == address(0) || _treasury == address(0) || _depository == address(0) || _dispenser == address(0) ||

284:             _ve == address(0) || _componentRegistry == address(0) || _agentRegistry == address(0) ||

391:         if (implementation == address(0)) {

411:         if (newOwner == address(0)) {

430:         if (_treasury != address(0)) {

435:         if (_depository != address(0)) {

440:         if (_dispenser != address(0)) {

457:         if (_componentRegistry != address(0)) {

461:         if (_agentRegistry != address(0)) {

465:         if (_serviceRegistry != address(0)) {

720:                 if (numServiceUnits == 0) {

732:                         if (lastEpoch == 0) {

801:         if (bList != address(0) && IDonatorBlacklist(bList).isDonatorBlacklisted(donator)) {

887:         if (implementation == address(0)) {

973:         if (tokenomicsParametersUpdated & 0x02 == 0x02) {

987:         if (tokenomicsParametersUpdated & 0x01 == 0x01) {

1063:         if (incentives[1] == 0 || ITreasury(treasury).rebalanceTreasury(incentives[1])) {

1255:         if (idf == 0) {

1265:         if (idf == 0) {

Github: [278, 283, 284, 391, 411, 430, 435, 440, 457, 461, 465, 720, 732, 801, 887, 973, 987, 1063, 1255, 1265]

File: tokenomics/contracts/TokenomicsProxy.sol

35:         if (tokenomics == address(0)) {

40:         if (tokenomicsData.length == 0) {

Github: [35, 40]

File: tokenomics/contracts/Treasury.sol

100:         if (_olas == address(0) || _tokenomics == address(0) || _depository == address(0) || _dispenser == address(0)) {

144:         if (newOwner == address(0)) {

163:         if (_tokenomics != address(0)) {

168:         if (_depository != address(0)) {

173:         if (_dispenser != address(0)) {

189:         if (_minAcceptedETH == 0) {

277:             if (amounts[i] == 0) {

325:         if (tokenAmount == 0) {

494:         if (token == address(0)) {

Github: [100, 144, 163, 168, 173, 189, 277, 325, 494]

[NC-15] Variable names for `constant`s should use CONSTANT_CASE

For constant variable names, each word should use all capital letters, with underscores separating each word (CONSTANT_CASE)

There are 7 instances of this issue:

File: governance/contracts/OLAS.sol

22:     uint256 public constant oneYear = 1 days * 365;

24:     uint256 public constant tenYearSupplyCap = 1_000_000_000e18;

26:     uint256 public constant maxMintCapFraction = 2;

Github: [22, 24, 26]

File: governance/contracts/veOLAS.sol

105:     uint8 public constant decimals = 18;

Github: [105]

File: governance/contracts/wveOLAS.sol

136:     string public constant name = "Voting Escrow OLAS";

138:     string public constant symbol = "veOLAS";

140:     uint8 public constant decimals = 18;

Github: [136, 138, 140]

[NC-16] `Constructor` should emit an event

Use events to signal significant changes to off-chain monitoring tools.

There are 24 instances (click to show):

File: governance/contracts/GovernorOLAS.sol

16:     constructor(

Github: [16]

File: governance/contracts/OLAS.sol

35:     constructor() ERC20("Autonolas", "OLAS", 18) {

Github: [35]

File: governance/contracts/Timelock.sol

10:     constructor(uint256 minDelay, address[] memory proposers, address[] memory executors)

Github: [10]

File: governance/contracts/bridges/BridgedERC20.sol

24:     constructor(string memory _name, string memory _symbol, uint8 _decimals) ERC20(_name, _symbol, _decimals) {

Github: [24]

File: governance/contracts/bridges/FxERC20ChildTunnel.sol

37:     constructor(address _fxChild, address _childToken, address _rootToken) FxBaseChildTunnel(_fxChild) {

Github: [37]

File: governance/contracts/bridges/FxERC20RootTunnel.sol

38:     constructor(address _checkpointManager, address _fxRoot, address _childToken, address _rootToken)

Github: [38]

File: governance/contracts/bridges/FxGovernorTunnel.sol

62:     constructor(address _fxChild, address _rootGovernor) {

Github: [62]

File: governance/contracts/bridges/HomeMediator.sol

62:     constructor(address _AMBContractProxyHome, address _foreignGovernor) {

Github: [62]

File: governance/contracts/multisigs/GuardCM.sol

138:     constructor(

Github: [138]

File: governance/contracts/veOLAS.sol

132:     constructor(address _token, string memory _name, string memory _symbol)

Github: [132]

File: governance/contracts/wveOLAS.sol

145:     constructor(address _ve, address _token) {

Github: [145]

File: registries/contracts/AgentRegistry.sol

20:     constructor(string memory _name, string memory _symbol, string memory _baseURI, address _componentRegistry)

Github: [20]

File: registries/contracts/ComponentRegistry.sol

16:     constructor(string memory _name, string memory _symbol, string memory _baseURI)

Github: [16]

File: registries/contracts/RegistriesManager.sol

15:     constructor(address _componentRegistry, address _agentRegistry) {

Github: [15]

File: registries/contracts/UnitRegistry.sol

35:     constructor(UnitType _unitType) {

Github: [35]

File: registries/contracts/multisigs/GnosisSafeMultisig.sol

37:     constructor (address payable _gnosisSafe, address _gnosisSafeProxyFactory) {

Github: [37]

File: registries/contracts/multisigs/GnosisSafeSameAddressMultisig.sol

60:     constructor(bytes32 _proxyHash) {

Github: [60]

File: tokenomics/contracts/Depository.sol

106:     constructor(address _olas, address _tokenomics, address _treasury, address _bondCalculator)

Github: [106]

File: tokenomics/contracts/Dispenser.sol

30:     constructor(address _tokenomics, address _treasury)

Github: [30]

File: tokenomics/contracts/DonatorBlacklist.sol

30:     constructor() {

Github: [30]

File: tokenomics/contracts/GenericBondCalculator.sol

29:     constructor(address _olas, address _tokenomics) {

Github: [29]

File: tokenomics/contracts/Tokenomics.sol

232:     constructor()

Github: [232]

File: tokenomics/contracts/TokenomicsProxy.sol

33:     constructor(address tokenomics, bytes memory tokenomicsData) {

Github: [33]

File: tokenomics/contracts/Treasury.sol

95:     constructor(address _olas, address _tokenomics, address _depository, address _dispenser) payable {

Github: [95]

[NC-17] Contract does not follow the Solidity Style Guide's suggested layout ordering

The style guide says that, within a contract, the ordering should be 1) Type declarations, 2) State variables, 3) Events, 4) Modifiers, and 5) Functions, but the contract(s) below do not follow this ordering

There are 192 instances (click to show):

File: governance/contracts/OLAS.sol

/// @audit event/error `MinterUpdated` came earlier
/// @audit event/error `OwnerUpdated` came earlier
/// @audit event/error `ManagerOnly` came earlier
/// @audit event/error `ZeroAddress` came earlier
22:     uint256 public constant oneYear = 1 days * 365;

/// @audit event/error `MinterUpdated` came earlier
/// @audit event/error `OwnerUpdated` came earlier
/// @audit event/error `ManagerOnly` came earlier
/// @audit event/error `ZeroAddress` came earlier
24:     uint256 public constant tenYearSupplyCap = 1_000_000_000e18;

/// @audit event/error `MinterUpdated` came earlier
/// @audit event/error `OwnerUpdated` came earlier
/// @audit event/error `ManagerOnly` came earlier
/// @audit event/error `ZeroAddress` came earlier
26:     uint256 public constant maxMintCapFraction = 2;

/// @audit event/error `MinterUpdated` came earlier
/// @audit event/error `OwnerUpdated` came earlier
/// @audit event/error `ManagerOnly` came earlier
/// @audit event/error `ZeroAddress` came earlier
28:     uint256 public immutable timeLaunch;

/// @audit event/error `MinterUpdated` came earlier
/// @audit event/error `OwnerUpdated` came earlier
/// @audit event/error `ManagerOnly` came earlier
/// @audit event/error `ZeroAddress` came earlier
31:     address public owner;

/// @audit event/error `MinterUpdated` came earlier
/// @audit event/error `OwnerUpdated` came earlier
/// @audit event/error `ManagerOnly` came earlier
/// @audit event/error `ZeroAddress` came earlier
33:     address public minter;

Github: [22, 24, 26, 28, 31, 33]

File: governance/contracts/bridges/BridgedERC20.sol

/// @audit event/error `OwnerUpdated` came earlier
/// @audit event/error `OwnerOnly` came earlier
/// @audit event/error `ZeroAddress` came earlier
22:     address public owner;

Github: [22]

File: governance/contracts/bridges/FxERC20ChildTunnel.sol

/// @audit event/error `FxDepositERC20` came earlier
/// @audit event/error `FxWithdrawERC20` came earlier
/// @audit event/error `ZeroAddress` came earlier
/// @audit event/error `ZeroValue` came earlier
/// @audit event/error `TransferFailed` came earlier
29:     address public immutable childToken;

/// @audit event/error `FxDepositERC20` came earlier
/// @audit event/error `FxWithdrawERC20` came earlier
/// @audit event/error `ZeroAddress` came earlier
/// @audit event/error `ZeroValue` came earlier
/// @audit event/error `TransferFailed` came earlier
31:     address public immutable rootToken;

Github: [29, 31]

File: governance/contracts/bridges/FxERC20RootTunnel.sol

/// @audit event/error `FxDepositERC20` came earlier
/// @audit event/error `FxWithdrawERC20` came earlier
/// @audit event/error `ZeroAddress` came earlier
/// @audit event/error `ZeroValue` came earlier
/// @audit event/error `TransferFailed` came earlier
29:     address public immutable childToken;

/// @audit event/error `FxDepositERC20` came earlier
/// @audit event/error `FxWithdrawERC20` came earlier
/// @audit event/error `ZeroAddress` came earlier
/// @audit event/error `ZeroValue` came earlier
/// @audit event/error `TransferFailed` came earlier
31:     address public immutable rootToken;

Github: [29, 31]

File: governance/contracts/bridges/FxGovernorTunnel.sol

/// @audit function `processMessageFromRoot` came earlier
10: error ZeroAddress();

/// @audit function `processMessageFromRoot` came earlier
15: error SelfCallOnly(address sender, address instance);

/// @audit function `processMessageFromRoot` came earlier
20: error FxChildOnly(address sender, address fxChild);

/// @audit function `processMessageFromRoot` came earlier
25: error RootGovernorOnly(address sender, address rootGovernor);

/// @audit function `processMessageFromRoot` came earlier
30: error IncorrectDataLength(uint256 expected, uint256 provided);

/// @audit function `processMessageFromRoot` came earlier
35: error InsufficientBalance(uint256 value, uint256 balance);

/// @audit function `processMessageFromRoot` came earlier
41: error TargetExecFailed(address target, uint256 value, bytes payload);

/// @audit function `processMessageFromRoot` came earlier
47:     event FundsReceived(address indexed sender, uint256 value);

/// @audit function `processMessageFromRoot` came earlier
48:     event RootGovernorUpdated(address indexed rootMessageSender);

/// @audit function `processMessageFromRoot` came earlier
49:     event MessageReceived(uint256 indexed stateId, address indexed rootMessageSender, bytes data);

/// @audit event/error `FundsReceived` came earlier
/// @audit event/error `RootGovernorUpdated` came earlier
/// @audit event/error `MessageReceived` came earlier
/// @audit event/error `ZeroAddress` came earlier
/// @audit event/error `SelfCallOnly` came earlier
/// @audit event/error `FxChildOnly` came earlier
/// @audit event/error `RootGovernorOnly` came earlier
/// @audit event/error `IncorrectDataLength` came earlier
/// @audit event/error `InsufficientBalance` came earlier
/// @audit event/error `TargetExecFailed` came earlier
/// @audit function `processMessageFromRoot` came earlier
53:     uint256 public constant DEFAULT_DATA_LENGTH = 36;

/// @audit event/error `FundsReceived` came earlier
/// @audit event/error `RootGovernorUpdated` came earlier
/// @audit event/error `MessageReceived` came earlier
/// @audit event/error `ZeroAddress` came earlier
/// @audit event/error `SelfCallOnly` came earlier
/// @audit event/error `FxChildOnly` came earlier
/// @audit event/error `RootGovernorOnly` came earlier
/// @audit event/error `IncorrectDataLength` came earlier
/// @audit event/error `InsufficientBalance` came earlier
/// @audit event/error `TargetExecFailed` came earlier
/// @audit function `processMessageFromRoot` came earlier
55:     address public immutable fxChild;

/// @audit event/error `FundsReceived` came earlier
/// @audit event/error `RootGovernorUpdated` came earlier
/// @audit event/error `MessageReceived` came earlier
/// @audit event/error `ZeroAddress` came earlier
/// @audit event/error `SelfCallOnly` came earlier
/// @audit event/error `FxChildOnly` came earlier
/// @audit event/error `RootGovernorOnly` came earlier
/// @audit event/error `IncorrectDataLength` came earlier
/// @audit event/error `InsufficientBalance` came earlier
/// @audit event/error `TargetExecFailed` came earlier
/// @audit function `processMessageFromRoot` came earlier
57:     address public rootGovernor;

Github: [10, 15, 20, 25, 30, 35, 41, 47, 48, 49, 53, 55, 57]

File: governance/contracts/bridges/HomeMediator.sol

/// @audit function `messageSender` came earlier
10: error ZeroAddress();

/// @audit function `messageSender` came earlier
15: error SelfCallOnly(address sender, address instance);

/// @audit function `messageSender` came earlier
20: error AMBContractProxyHomeOnly(address sender, address AMBContractProxyHome);

/// @audit function `messageSender` came earlier
25: error ForeignGovernorOnly(address sender, address foreignGovernor);

/// @audit function `messageSender` came earlier
30: error IncorrectDataLength(uint256 expected, uint256 provided);

/// @audit function `messageSender` came earlier
35: error InsufficientBalance(uint256 value, uint256 balance);

/// @audit function `messageSender` came earlier
41: error TargetExecFailed(address target, uint256 value, bytes payload);

/// @audit function `messageSender` came earlier
47:     event FundsReceived(address indexed sender, uint256 value);

/// @audit function `messageSender` came earlier
48:     event ForeignGovernorUpdated(address indexed foreignMessageSender);

/// @audit function `messageSender` came earlier
49:     event MessageReceived(address indexed foreignMessageSender, bytes data);

/// @audit event/error `FundsReceived` came earlier
/// @audit event/error `ForeignGovernorUpdated` came earlier
/// @audit event/error `MessageReceived` came earlier
/// @audit event/error `ZeroAddress` came earlier
/// @audit event/error `SelfCallOnly` came earlier
/// @audit event/error `AMBContractProxyHomeOnly` came earlier
/// @audit event/error `ForeignGovernorOnly` came earlier
/// @audit event/error `IncorrectDataLength` came earlier
/// @audit event/error `InsufficientBalance` came earlier
/// @audit event/error `TargetExecFailed` came earlier
/// @audit function `messageSender` came earlier
53:     uint256 public constant DEFAULT_DATA_LENGTH = 36;

/// @audit event/error `FundsReceived` came earlier
/// @audit event/error `ForeignGovernorUpdated` came earlier
/// @audit event/error `MessageReceived` came earlier
/// @audit event/error `ZeroAddress` came earlier
/// @audit event/error `SelfCallOnly` came earlier
/// @audit event/error `AMBContractProxyHomeOnly` came earlier
/// @audit event/error `ForeignGovernorOnly` came earlier
/// @audit event/error `IncorrectDataLength` came earlier
/// @audit event/error `InsufficientBalance` came earlier
/// @audit event/error `TargetExecFailed` came earlier
/// @audit function `messageSender` came earlier
55:     address public immutable AMBContractProxyHome;

/// @audit event/error `FundsReceived` came earlier
/// @audit event/error `ForeignGovernorUpdated` came earlier
/// @audit event/error `MessageReceived` came earlier
/// @audit event/error `ZeroAddress` came earlier
/// @audit event/error `SelfCallOnly` came earlier
/// @audit event/error `AMBContractProxyHomeOnly` came earlier
/// @audit event/error `ForeignGovernorOnly` came earlier
/// @audit event/error `IncorrectDataLength` came earlier
/// @audit event/error `InsufficientBalance` came earlier
/// @audit event/error `TargetExecFailed` came earlier
/// @audit function `messageSender` came earlier
57:     address public foreignGovernor;

Github: [10, 15, 20, 25, 30, 35, 41, 47, 48, 49, 53, 55, 57]

File: governance/contracts/multisigs/GuardCM.sol

/// @audit function `state` came earlier
11: enum ProposalState {

/// @audit function `state` came earlier
25: error OwnerOnly(address sender, address owner);

/// @audit function `state` came earlier
30: error ManagerOnly(address sender, address manager);

/// @audit function `state` came earlier
33: error ZeroAddress();

/// @audit function `state` came earlier
36: error ZeroValue();

/// @audit function `state` came earlier
43: error WrongArrayLength(uint256 numValues1, uint256 numValues2, uint256 numValues3, uint256 numValues4);

/// @audit function `state` came earlier
47: error BridgeMediatorNotUnique(address bridgeMediator);

/// @audit function `state` came earlier
52: error IncorrectDataLength(uint256 expected, uint256 provided);

/// @audit function `state` came earlier
55: error NoDelegateCall();

/// @audit function `state` came earlier
58: error NoSelfCall();

/// @audit function `state` came earlier
64: error NotAuthorized(address target, bytes4 selector, uint256 chainId);

/// @audit function `state` came earlier
69: error NotDefeated(uint256 proposalId, ProposalState state);

/// @audit function `state` came earlier
73: error L2ChainIdNotSupported(uint256 chainId);

/// @audit function `state` came earlier
78: error WrongSelector(bytes4 functionSig, uint256 chainId);

/// @audit function `state` came earlier
83: error WrongL2BridgeMediator(address provided, address expected);

/// @audit function `state` came earlier
89:     event GovernorUpdated(address indexed governor);

/// @audit function `state` came earlier
90:     event SetTargetSelectors(address[] indexed targets, bytes4[] indexed selectors, uint256[] chainIds, bool[] statuses);

/// @audit function `state` came earlier
91:     event SetBridgeMediators(address[] indexed bridgeMediatorL1s, address[] indexed bridgeMediatorL2s, uint256[] chainIds);

/// @audit function `state` came earlier
92:     event GovernorCheckProposalIdChanged(uint256 indexed proposalId);

/// @audit function `state` came earlier
93:     event GuardPaused(address indexed account);

/// @audit function `state` came earlier
94:     event GuardUnpaused();

/// @audit event/error `GovernorUpdated` came earlier
/// @audit event/error `SetTargetSelectors` came earlier
/// @audit event/error `SetBridgeMediators` came earlier
/// @audit event/error `GovernorCheckProposalIdChanged` came earlier
/// @audit event/error `GuardPaused` came earlier
/// @audit event/error `GuardUnpaused` came earlier
/// @audit event/error `OwnerOnly` came earlier
/// @audit event/error `ManagerOnly` came earlier
/// @audit event/error `ZeroAddress` came earlier
/// @audit event/error `ZeroValue` came earlier
/// @audit event/error `WrongArrayLength` came earlier
/// @audit event/error `BridgeMediatorNotUnique` came earlier
/// @audit event/error `IncorrectDataLength` came earlier
/// @audit event/error `NoDelegateCall` came earlier
/// @audit event/error `NoSelfCall` came earlier
/// @audit event/error `NotAuthorized` came earlier
/// @audit event/error `NotDefeated` came earlier
/// @audit event/error `L2ChainIdNotSupported` came earlier
/// @audit event/error `WrongSelector` came earlier
/// @audit event/error `WrongL2BridgeMediator` came earlier
/// @audit function `state` came earlier
97:     bytes4 public constant SCHEDULE = bytes4(keccak256(bytes("schedule(address,uint256,bytes,bytes32,bytes32,uint256)")));

/// @audit event/error `GovernorUpdated` came earlier
/// @audit event/error `SetTargetSelectors` came earlier
/// @audit event/error `SetBridgeMediators` came earlier
/// @audit event/error `GovernorCheckProposalIdChanged` came earlier
/// @audit event/error `GuardPaused` came earlier
/// @audit event/error `GuardUnpaused` came earlier
/// @audit event/error `OwnerOnly` came earlier
/// @audit event/error `ManagerOnly` came earlier
/// @audit event/error `ZeroAddress` came earlier
/// @audit event/error `ZeroValue` came earlier
/// @audit event/error `WrongArrayLength` came earlier
/// @audit event/error `BridgeMediatorNotUnique` came earlier
/// @audit event/error `IncorrectDataLength` came earlier
/// @audit event/error `NoDelegateCall` came earlier
/// @audit event/error `NoSelfCall` came earlier
/// @audit event/error `NotAuthorized` came earlier
/// @audit event/error `NotDefeated` came earlier
/// @audit event/error `L2ChainIdNotSupported` came earlier
/// @audit event/error `WrongSelector` came earlier
/// @audit event/error `WrongL2BridgeMediator` came earlier
/// @audit function `state` came earlier
99:     bytes4 public constant SCHEDULE_BATCH = bytes4(keccak256(bytes("scheduleBatch(address[],uint256[],bytes[],bytes32,bytes32,uint256)")));

/// @audit event/error `GovernorUpdated` came earlier
/// @audit event/error `SetTargetSelectors` came earlier
/// @audit event/error `SetBridgeMediators` came earlier
/// @audit event/error `GovernorCheckProposalIdChanged` came earlier
/// @audit event/error `GuardPaused` came earlier
/// @audit event/error `GuardUnpaused` came earlier
/// @audit event/error `OwnerOnly` came earlier
/// @audit event/error `ManagerOnly` came earlier
/// @audit event/error `ZeroAddress` came earlier
/// @audit event/error `ZeroValue` came earlier
/// @audit event/error `WrongArrayLength` came earlier
/// @audit event/error `BridgeMediatorNotUnique` came earlier
/// @audit event/error `IncorrectDataLength` came earlier
/// @audit event/error `NoDelegateCall` came earlier
/// @audit event/error `NoSelfCall` came earlier
/// @audit event/error `NotAuthorized` came earlier
/// @audit event/error `NotDefeated` came earlier
/// @audit event/error `L2ChainIdNotSupported` came earlier
/// @audit event/error `WrongSelector` came earlier
/// @audit event/error `WrongL2BridgeMediator` came earlier
/// @audit function `state` came earlier
101:     bytes4 public constant REQUIRE_TO_PASS_MESSAGE = bytes4(keccak256(bytes("requireToPassMessage(address,bytes,uint256)")));

/// @audit event/error `GovernorUpdated` came earlier
/// @audit event/error `SetTargetSelectors` came earlier
/// @audit event/error `SetBridgeMediators` came earlier
/// @audit event/error `GovernorCheckProposalIdChanged` came earlier
/// @audit event/error `GuardPaused` came earlier
/// @audit event/error `GuardUnpaused` came earlier
/// @audit event/error `OwnerOnly` came earlier
/// @audit event/error `ManagerOnly` came earlier
/// @audit event/error `ZeroAddress` came earlier
/// @audit event/error `ZeroValue` came earlier
/// @audit event/error `WrongArrayLength` came earlier
/// @audit event/error `BridgeMediatorNotUnique` came earlier
/// @audit event/error `IncorrectDataLength` came earlier
/// @audit event/error `NoDelegateCall` came earlier
/// @audit event/error `NoSelfCall` came earlier
/// @audit event/error `NotAuthorized` came earlier
/// @audit event/error `NotDefeated` came earlier
/// @audit event/error `L2ChainIdNotSupported` came earlier
/// @audit event/error `WrongSelector` came earlier
/// @audit event/error `WrongL2BridgeMediator` came earlier
/// @audit function `state` came earlier
103:     bytes4 public constant PROCESS_MESSAGE_FROM_FOREIGN = bytes4(keccak256(bytes("processMessageFromForeign(bytes)")));

/// @audit event/error `GovernorUpdated` came earlier
/// @audit event/error `SetTargetSelectors` came earlier
/// @audit event/error `SetBridgeMediators` came earlier
/// @audit event/error `GovernorCheckProposalIdChanged` came earlier
/// @audit event/error `GuardPaused` came earlier
/// @audit event/error `GuardUnpaused` came earlier
/// @audit event/error `OwnerOnly` came earlier
/// @audit event/error `ManagerOnly` came earlier
/// @audit event/error `ZeroAddress` came earlier
/// @audit event/error `ZeroValue` came earlier
/// @audit event/error `WrongArrayLength` came earlier
/// @audit event/error `BridgeMediatorNotUnique` came earlier
/// @audit event/error `IncorrectDataLength` came earlier
/// @audit event/error `NoDelegateCall` came earlier
/// @audit event/error `NoSelfCall` came earlier
/// @audit event/error `NotAuthorized` came earlier
/// @audit event/error `NotDefeated` came earlier
/// @audit event/error `L2ChainIdNotSupported` came earlier
/// @audit event/error `WrongSelector` came earlier
/// @audit event/error `WrongL2BridgeMediator` came earlier
/// @audit function `state` came earlier
105:     bytes4 public constant SEND_MESSAGE_TO_CHILD = bytes4(keccak256(bytes("sendMessageToChild(address,bytes)")));

/// @audit event/error `GovernorUpdated` came earlier
/// @audit event/error `SetTargetSelectors` came earlier
/// @audit event/error `SetBridgeMediators` came earlier
/// @audit event/error `GovernorCheckProposalIdChanged` came earlier
/// @audit event/error `GuardPaused` came earlier
/// @audit event/error `GuardUnpaused` came earlier
/// @audit event/error `OwnerOnly` came earlier
/// @audit event/error `ManagerOnly` came earlier
/// @audit event/error `ZeroAddress` came earlier
/// @audit event/error `ZeroValue` came earlier
/// @audit event/error `WrongArrayLength` came earlier
/// @audit event/error `BridgeMediatorNotUnique` came earlier
/// @audit event/error `IncorrectDataLength` came earlier
/// @audit event/error `NoDelegateCall` came earlier
/// @audit event/error `NoSelfCall` came earlier
/// @audit event/error `NotAuthorized` came earlier
/// @audit event/error `NotDefeated` came earlier
/// @audit event/error `L2ChainIdNotSupported` came earlier
/// @audit event/error `WrongSelector` came earlier
/// @audit event/error `WrongL2BridgeMediator` came earlier
/// @audit function `state` came earlier
108:     uint256 public governorCheckProposalId = 88250008686885504216650933897987879122244685460173810624866685274624741477673;

/// @audit event/error `GovernorUpdated` came earlier
/// @audit event/error `SetTargetSelectors` came earlier
/// @audit event/error `SetBridgeMediators` came earlier
/// @audit event/error `GovernorCheckProposalIdChanged` came earlier
/// @audit event/error `GuardPaused` came earlier
/// @audit event/error `GuardUnpaused` came earlier
/// @audit event/error `OwnerOnly` came earlier
/// @audit event/error `ManagerOnly` came earlier
/// @audit event/error `ZeroAddress` came earlier
/// @audit event/error `ZeroValue` came earlier
/// @audit event/error `WrongArrayLength` came earlier
/// @audit event/error `BridgeMediatorNotUnique` came earlier
/// @audit event/error `IncorrectDataLength` came earlier
/// @audit event/error `NoDelegateCall` came earlier
/// @audit event/error `NoSelfCall` came earlier
/// @audit event/error `NotAuthorized` came earlier
/// @audit event/error `NotDefeated` came earlier
/// @audit event/error `L2ChainIdNotSupported` came earlier
/// @audit event/error `WrongSelector` came earlier
/// @audit event/error `WrongL2BridgeMediator` came earlier
/// @audit function `state` came earlier
111:     uint256 public constant MIN_SCHEDULE_DATA_LENGTH = 260;

/// @audit event/error `GovernorUpdated` came earlier
/// @audit event/error `SetTargetSelectors` came earlier
/// @audit event/error `SetBridgeMediators` came earlier
/// @audit event/error `GovernorCheckProposalIdChanged` came earlier
/// @audit event/error `GuardPaused` came earlier
/// @audit event/error `GuardUnpaused` came earlier
/// @audit event/error `OwnerOnly` came earlier
/// @audit event/error `ManagerOnly` came earlier
/// @audit event/error `ZeroAddress` came earlier
/// @audit event/error `ZeroValue` came earlier
/// @audit event/error `WrongArrayLength` came earlier
/// @audit event/error `BridgeMediatorNotUnique` came earlier
/// @audit event/error `IncorrectDataLength` came earlier
/// @audit event/error `NoDelegateCall` came earlier
/// @audit event/error `NoSelfCall` came earlier
/// @audit event/error `NotAuthorized` came earlier
/// @audit event/error `NotDefeated` came earlier
/// @audit event/error `L2ChainIdNotSupported` came earlier
/// @audit event/error `WrongSelector` came earlier
/// @audit event/error `WrongL2BridgeMediator` came earlier
/// @audit function `state` came earlier
113:     uint256 public constant SELECTOR_DATA_LENGTH = 4;

/// @audit event/error `GovernorUpdated` came earlier
/// @audit event/error `SetTargetSelectors` came earlier
/// @audit event/error `SetBridgeMediators` came earlier
/// @audit event/error `GovernorCheckProposalIdChanged` came earlier
/// @audit event/error `GuardPaused` came earlier
/// @audit event/error `GuardUnpaused` came earlier
/// @audit event/error `OwnerOnly` came earlier
/// @audit event/error `ManagerOnly` came earlier
/// @audit event/error `ZeroAddress` came earlier
/// @audit event/error `ZeroValue` came earlier
/// @audit event/error `WrongArrayLength` came earlier
/// @audit event/error `BridgeMediatorNotUnique` came earlier
/// @audit event/error `IncorrectDataLength` came earlier
/// @audit event/error `NoDelegateCall` came earlier
/// @audit event/error `NoSelfCall` came earlier
/// @audit event/error `NotAuthorized` came earlier
/// @audit event/error `NotDefeated` came earlier
/// @audit event/error `L2ChainIdNotSupported` came earlier
/// @audit event/error `WrongSelector` came earlier
/// @audit event/error `WrongL2BridgeMediator` came earlier
/// @audit function `state` came earlier
115:     uint256 public constant MIN_GNOSIS_PAYLOAD_LENGTH = 292;

/// @audit event/error `GovernorUpdated` came earlier
/// @audit event/error `SetTargetSelectors` came earlier
/// @audit event/error `SetBridgeMediators` came earlier
/// @audit event/error `GovernorCheckProposalIdChanged` came earlier
/// @audit event/error `GuardPaused` came earlier
/// @audit event/error `GuardUnpaused` came earlier
/// @audit event/error `OwnerOnly` came earlier
/// @audit event/error `ManagerOnly` came earlier
/// @audit event/error `ZeroAddress` came earlier
/// @audit event/error `ZeroValue` came earlier
/// @audit event/error `WrongArrayLength` came earlier
/// @audit event/error `BridgeMediatorNotUnique` came earlier
/// @audit event/error `IncorrectDataLength` came earlier
/// @audit event/error `NoDelegateCall` came earlier
/// @audit event/error `NoSelfCall` came earlier
/// @audit event/error `NotAuthorized` came earlier
/// @audit event/error `NotDefeated` came earlier
/// @audit event/error `L2ChainIdNotSupported` came earlier
/// @audit event/error `WrongSelector` came earlier
/// @audit event/error `WrongL2BridgeMediator` came earlier
/// @audit function `state` came earlier
117:     uint256 public constant MIN_POLYGON_PAYLOAD_LENGTH = 164;

/// @audit event/error `GovernorUpdated` came earlier
/// @audit event/error `SetTargetSelectors` came earlier
/// @audit event/error `SetBridgeMediators` came earlier
/// @audit event/error `GovernorCheckProposalIdChanged` came earlier
/// @audit event/error `GuardPaused` came earlier
/// @audit event/error `GuardUnpaused` came earlier
/// @audit event/error `OwnerOnly` came earlier
/// @audit event/error `ManagerOnly` came earlier
/// @audit event/error `ZeroAddress` came earlier
/// @audit event/error `ZeroValue` came earlier
/// @audit event/error `WrongArrayLength` came earlier
/// @audit event/error `BridgeMediatorNotUnique` came earlier
/// @audit event/error `IncorrectDataLength` came earlier
/// @audit event/error `NoDelegateCall` came earlier
/// @audit event/error `NoSelfCall` came earlier
/// @audit event/error `NotAuthorized` came earlier
/// @audit event/error `NotDefeated` came earlier
/// @audit event/error `L2ChainIdNotSupported` came earlier
/// @audit event/error `WrongSelector` came earlier
/// @audit event/error `WrongL2BridgeMediator` came earlier
/// @audit function `state` came earlier
120:     address public immutable owner;

/// @audit event/error `GovernorUpdated` came earlier
/// @audit event/error `SetTargetSelectors` came earlier
/// @audit event/error `SetBridgeMediators` came earlier
/// @audit event/error `GovernorCheckProposalIdChanged` came earlier
/// @audit event/error `GuardPaused` came earlier
/// @audit event/error `GuardUnpaused` came earlier
/// @audit event/error `OwnerOnly` came earlier
/// @audit event/error `ManagerOnly` came earlier
/// @audit event/error `ZeroAddress` came earlier
/// @audit event/error `ZeroValue` came earlier
/// @audit event/error `WrongArrayLength` came earlier
/// @audit event/error `BridgeMediatorNotUnique` came earlier
/// @audit event/error `IncorrectDataLength` came earlier
/// @audit event/error `NoDelegateCall` came earlier
/// @audit event/error `NoSelfCall` came earlier
/// @audit event/error `NotAuthorized` came earlier
/// @audit event/error `NotDefeated` came earlier
/// @audit event/error `L2ChainIdNotSupported` came earlier
/// @audit event/error `WrongSelector` came earlier
/// @audit event/error `WrongL2BridgeMediator` came earlier
/// @audit function `state` came earlier
122:     address public immutable multisig;

/// @audit event/error `GovernorUpdated` came earlier
/// @audit event/error `SetTargetSelectors` came earlier
/// @audit event/error `SetBridgeMediators` came earlier
/// @audit event/error `GovernorCheckProposalIdChanged` came earlier
/// @audit event/error `GuardPaused` came earlier
/// @audit event/error `GuardUnpaused` came earlier
/// @audit event/error `OwnerOnly` came earlier
/// @audit event/error `ManagerOnly` came earlier
/// @audit event/error `ZeroAddress` came earlier
/// @audit event/error `ZeroValue` came earlier
/// @audit event/error `WrongArrayLength` came earlier
/// @audit event/error `BridgeMediatorNotUnique` came earlier
/// @audit event/error `IncorrectDataLength` came earlier
/// @audit event/error `NoDelegateCall` came earlier
/// @audit event/error `NoSelfCall` came earlier
/// @audit event/error `NotAuthorized` came earlier
/// @audit event/error `NotDefeated` came earlier
/// @audit event/error `L2ChainIdNotSupported` came earlier
/// @audit event/error `WrongSelector` came earlier
/// @audit event/error `WrongL2BridgeMediator` came earlier
/// @audit function `state` came earlier
125:     address public governor;

/// @audit event/error `GovernorUpdated` came earlier
/// @audit event/error `SetTargetSelectors` came earlier
/// @audit event/error `SetBridgeMediators` came earlier
/// @audit event/error `GovernorCheckProposalIdChanged` came earlier
/// @audit event/error `GuardPaused` came earlier
/// @audit event/error `GuardUnpaused` came earlier
/// @audit event/error `OwnerOnly` came earlier
/// @audit event/error `ManagerOnly` came earlier
/// @audit event/error `ZeroAddress` came earlier
/// @audit event/error `ZeroValue` came earlier
/// @audit event/error `WrongArrayLength` came earlier
/// @audit event/error `BridgeMediatorNotUnique` came earlier
/// @audit event/error `IncorrectDataLength` came earlier
/// @audit event/error `NoDelegateCall` came earlier
/// @audit event/error `NoSelfCall` came earlier
/// @audit event/error `NotAuthorized` came earlier
/// @audit event/error `NotDefeated` came earlier
/// @audit event/error `L2ChainIdNotSupported` came earlier
/// @audit event/error `WrongSelector` came earlier
/// @audit event/error `WrongL2BridgeMediator` came earlier
/// @audit function `state` came earlier
127:     uint8 public paused = 1;

/// @audit event/error `GovernorUpdated` came earlier
/// @audit event/error `SetTargetSelectors` came earlier
/// @audit event/error `SetBridgeMediators` came earlier
/// @audit event/error `GovernorCheckProposalIdChanged` came earlier
/// @audit event/error `GuardPaused` came earlier
/// @audit event/error `GuardUnpaused` came earlier
/// @audit event/error `OwnerOnly` came earlier
/// @audit event/error `ManagerOnly` came earlier
/// @audit event/error `ZeroAddress` came earlier
/// @audit event/error `ZeroValue` came earlier
/// @audit event/error `WrongArrayLength` came earlier
/// @audit event/error `BridgeMediatorNotUnique` came earlier
/// @audit event/error `IncorrectDataLength` came earlier
/// @audit event/error `NoDelegateCall` came earlier
/// @audit event/error `NoSelfCall` came earlier
/// @audit event/error `NotAuthorized` came earlier
/// @audit event/error `NotDefeated` came earlier
/// @audit event/error `L2ChainIdNotSupported` came earlier
/// @audit event/error `WrongSelector` came earlier
/// @audit event/error `WrongL2BridgeMediator` came earlier
/// @audit function `state` came earlier
130:     mapping(uint256 => bool) public mapAllowedTargetSelectorChainIds;

/// @audit event/error `GovernorUpdated` came earlier
/// @audit event/error `SetTargetSelectors` came earlier
/// @audit event/error `SetBridgeMediators` came earlier
/// @audit event/error `GovernorCheckProposalIdChanged` came earlier
/// @audit event/error `GuardPaused` came earlier
/// @audit event/error `GuardUnpaused` came earlier
/// @audit event/error `OwnerOnly` came earlier
/// @audit event/error `ManagerOnly` came earlier
/// @audit event/error `ZeroAddress` came earlier
/// @audit event/error `ZeroValue` came earlier
/// @audit event/error `WrongArrayLength` came earlier
/// @audit event/error `BridgeMediatorNotUnique` came earlier
/// @audit event/error `IncorrectDataLength` came earlier
/// @audit event/error `NoDelegateCall` came earlier
/// @audit event/error `NoSelfCall` came earlier
/// @audit event/error `NotAuthorized` came earlier
/// @audit event/error `NotDefeated` came earlier
/// @audit event/error `L2ChainIdNotSupported` came earlier
/// @audit event/error `WrongSelector` came earlier
/// @audit event/error `WrongL2BridgeMediator` came earlier
/// @audit function `state` came earlier
132:     mapping(address => uint256) public mapBridgeMediatorL1L2ChainIds;

Github: [11, 25, 30, 33, 36, 43, 47, 52, 55, 58, 64, 69, 73, 78, 83, 89, 90, 91, 92, 93, 94, 97, 99, 101, 103, 105, 108, 111, 113, 115, 117, 120, 122, 125, 127, 130, 132]

File: governance/contracts/veOLAS.sol

/// @audit event/error `Deposit` came earlier
/// @audit event/error `Withdraw` came earlier
/// @audit event/error `Supply` came earlier
99:     uint64 internal constant WEEK = 1 weeks;

/// @audit event/error `Deposit` came earlier
/// @audit event/error `Withdraw` came earlier
/// @audit event/error `Supply` came earlier
101:     uint256 internal constant MAXTIME = 4 * 365 * 86400;

/// @audit event/error `Deposit` came earlier
/// @audit event/error `Withdraw` came earlier
/// @audit event/error `Supply` came earlier
103:     int128 internal constant IMAXTIME = 4 * 365 * 86400;

/// @audit event/error `Deposit` came earlier
/// @audit event/error `Withdraw` came earlier
/// @audit event/error `Supply` came earlier
105:     uint8 public constant decimals = 18;

/// @audit event/error `Deposit` came earlier
/// @audit event/error `Withdraw` came earlier
/// @audit event/error `Supply` came earlier
108:     address public immutable token;

/// @audit event/error `Deposit` came earlier
/// @audit event/error `Withdraw` came earlier
/// @audit event/error `Supply` came earlier
110:     uint256 public supply;

/// @audit event/error `Deposit` came earlier
/// @audit event/error `Withdraw` came earlier
/// @audit event/error `Supply` came earlier
112:     mapping(address => LockedBalance) public mapLockedBalances;

/// @audit event/error `Deposit` came earlier
/// @audit event/error `Withdraw` came earlier
/// @audit event/error `Supply` came earlier
115:     uint256 public totalNumPoints;

/// @audit event/error `Deposit` came earlier
/// @audit event/error `Withdraw` came earlier
/// @audit event/error `Supply` came earlier
117:     mapping(uint256 => PointVoting) public mapSupplyPoints;

/// @audit event/error `Deposit` came earlier
/// @audit event/error `Withdraw` came earlier
/// @audit event/error `Supply` came earlier
119:     mapping(address => PointVoting[]) public mapUserPoints;

/// @audit event/error `Deposit` came earlier
/// @audit event/error `Withdraw` came earlier
/// @audit event/error `Supply` came earlier
121:     mapping(uint64 => int128) public mapSlopeChanges;

/// @audit event/error `Deposit` came earlier
/// @audit event/error `Withdraw` came earlier
/// @audit event/error `Supply` came earlier
124:     string public name;

/// @audit event/error `Deposit` came earlier
/// @audit event/error `Withdraw` came earlier
/// @audit event/error `Supply` came earlier
126:     string public symbol;

Github: [99, 101, 103, 105, 108, 110, 112, 115, 117, 119, 121, 124, 126]

File: governance/contracts/wveOLAS.sol

/// @audit function `totalNumPoints` came earlier
/// @audit function `mapSupplyPoints` came earlier
/// @audit function `mapSlopeChanges` came earlier
/// @audit function `getLastUserPoint` came earlier
/// @audit function `getNumUserPoints` came earlier
/// @audit function `getUserPoint` came earlier
/// @audit function `getPastVotes` came earlier
/// @audit function `balanceOf` came earlier
/// @audit function `balanceOfAt` came earlier
/// @audit function `lockedEnd` came earlier
/// @audit function `getVotes` came earlier
/// @audit function `totalSupply` came earlier
/// @audit function `totalSupplyAt` came earlier
/// @audit function `totalSupplyLockedAtT` came earlier
/// @audit function `totalSupplyLocked` came earlier
/// @audit function `getPastTotalSupply` came earlier
/// @audit function `supportsInterface` came earlier
/// @audit function `allowance` came earlier
/// @audit function `delegates` came earlier
108: error ZeroAddress();

/// @audit function `totalNumPoints` came earlier
/// @audit function `mapSupplyPoints` came earlier
/// @audit function `mapSlopeChanges` came earlier
/// @audit function `getLastUserPoint` came earlier
/// @audit function `getNumUserPoints` came earlier
/// @audit function `getUserPoint` came earlier
/// @audit function `getPastVotes` came earlier
/// @audit function `balanceOf` came earlier
/// @audit function `balanceOfAt` came earlier
/// @audit function `lockedEnd` came earlier
/// @audit function `getVotes` came earlier
/// @audit function `totalSupply` came earlier
/// @audit function `totalSupplyAt` came earlier
/// @audit function `totalSupplyLockedAtT` came earlier
/// @audit function `totalSupplyLocked` came earlier
/// @audit function `getPastTotalSupply` came earlier
/// @audit function `supportsInterface` came earlier
/// @audit function `allowance` came earlier
/// @audit function `delegates` came earlier
113: error WrongTimestamp(uint256 minTimeStamp, uint256 providedTimeStamp);

/// @audit function `totalNumPoints` came earlier
/// @audit function `mapSupplyPoints` came earlier
/// @audit function `mapSlopeChanges` came earlier
/// @audit function `getLastUserPoint` came earlier
/// @audit function `getNumUserPoints` came earlier
/// @audit function `getUserPoint` came earlier
/// @audit function `getPastVotes` came earlier
/// @audit function `balanceOf` came earlier
/// @audit function `balanceOfAt` came earlier
/// @audit function `lockedEnd` came earlier
/// @audit function `getVotes` came earlier
/// @audit function `totalSupply` came earlier
/// @audit function `totalSupplyAt` came earlier
/// @audit function `totalSupplyLockedAtT` came earlier
/// @audit function `totalSupplyLocked` came earlier
/// @audit function `getPastTotalSupply` came earlier
/// @audit function `supportsInterface` came earlier
/// @audit function `allowance` came earlier
/// @audit function `delegates` came earlier
117: error ImplementedIn(address veToken);

/// @audit function `totalNumPoints` came earlier
/// @audit function `mapSupplyPoints` came earlier
/// @audit function `mapSlopeChanges` came earlier
/// @audit function `getLastUserPoint` came earlier
/// @audit function `getNumUserPoints` came earlier
/// @audit function `getUserPoint` came earlier
/// @audit function `getPastVotes` came earlier
/// @audit function `balanceOf` came earlier
/// @audit function `balanceOfAt` came earlier
/// @audit function `lockedEnd` came earlier
/// @audit function `getVotes` came earlier
/// @audit function `totalSupply` came earlier
/// @audit function `totalSupplyAt` came earlier
/// @audit function `totalSupplyLockedAtT` came earlier
/// @audit function `totalSupplyLocked` came earlier
/// @audit function `getPastTotalSupply` came earlier
/// @audit function `supportsInterface` came earlier
/// @audit function `allowance` came earlier
/// @audit function `delegates` came earlier
121: error NonTransferable(address veToken);

/// @audit function `totalNumPoints` came earlier
/// @audit function `mapSupplyPoints` came earlier
/// @audit function `mapSlopeChanges` came earlier
/// @audit function `getLastUserPoint` came earlier
/// @audit function `getNumUserPoints` came earlier
/// @audit function `getUserPoint` came earlier
/// @audit function `getPastVotes` came earlier
/// @audit function `balanceOf` came earlier
/// @audit function `balanceOfAt` came earlier
/// @audit function `lockedEnd` came earlier
/// @audit function `getVotes` came earlier
/// @audit function `totalSupply` came earlier
/// @audit function `totalSupplyAt` came earlier
/// @audit function `totalSupplyLockedAtT` came earlier
/// @audit function `totalSupplyLocked` came earlier
/// @audit function `getPastTotalSupply` came earlier
/// @audit function `supportsInterface` came earlier
/// @audit function `allowance` came earlier
/// @audit function `delegates` came earlier
125: error NonDelegatable(address veToken);

/// @audit event/error `ZeroAddress` came earlier
/// @audit event/error `WrongTimestamp` came earlier
/// @audit event/error `ImplementedIn` came earlier
/// @audit event/error `NonTransferable` came earlier
/// @audit event/error `NonDelegatable` came earlier
/// @audit function `totalNumPoints` came earlier
/// @audit function `mapSupplyPoints` came earlier
/// @audit function `mapSlopeChanges` came earlier
/// @audit function `getLastUserPoint` came earlier
/// @audit function `getNumUserPoints` came earlier
/// @audit function `getUserPoint` came earlier
/// @audit function `getPastVotes` came earlier
/// @audit function `balanceOf` came earlier
/// @audit function `balanceOfAt` came earlier
/// @audit function `lockedEnd` came earlier
/// @audit function `getVotes` came earlier
/// @audit function `totalSupply` came earlier
/// @audit function `totalSupplyAt` came earlier
/// @audit function `totalSupplyLockedAtT` came earlier
/// @audit function `totalSupplyLocked` came earlier
/// @audit function `getPastTotalSupply` came earlier
/// @audit function `supportsInterface` came earlier
/// @audit function `allowance` came earlier
/// @audit function `delegates` came earlier
132:     address public immutable ve;

/// @audit event/error `ZeroAddress` came earlier
/// @audit event/error `WrongTimestamp` came earlier
/// @audit event/error `ImplementedIn` came earlier
/// @audit event/error `NonTransferable` came earlier
/// @audit event/error `NonDelegatable` came earlier
/// @audit function `totalNumPoints` came earlier
/// @audit function `mapSupplyPoints` came earlier
/// @audit function `mapSlopeChanges` came earlier
/// @audit function `getLastUserPoint` came earlier
/// @audit function `getNumUserPoints` came earlier
/// @audit function `getUserPoint` came earlier
/// @audit function `getPastVotes` came earlier
/// @audit function `balanceOf` came earlier
/// @audit function `balanceOfAt` came earlier
/// @audit function `lockedEnd` came earlier
/// @audit function `getVotes` came earlier
/// @audit function `totalSupply` came earlier
/// @audit function `totalSupplyAt` came earlier
/// @audit function `totalSupplyLockedAtT` came earlier
/// @audit function `totalSupplyLocked` came earlier
/// @audit function `getPastTotalSupply` came earlier
/// @audit function `supportsInterface` came earlier
/// @audit function `allowance` came earlier
/// @audit function `delegates` came earlier
134:     address public immutable token;

/// @audit event/error `ZeroAddress` came earlier
/// @audit event/error `WrongTimestamp` came earlier
/// @audit event/error `ImplementedIn` came earlier
/// @audit event/error `NonTransferable` came earlier
/// @audit event/error `NonDelegatable` came earlier
/// @audit function `totalNumPoints` came earlier
/// @audit function `mapSupplyPoints` came earlier
/// @audit function `mapSlopeChanges` came earlier
/// @audit function `getLastUserPoint` came earlier
/// @audit function `getNumUserPoints` came earlier
/// @audit function `getUserPoint` came earlier
/// @audit function `getPastVotes` came earlier
/// @audit function `balanceOf` came earlier
/// @audit function `balanceOfAt` came earlier
/// @audit function `lockedEnd` came earlier
/// @audit function `getVotes` came earlier
/// @audit function `totalSupply` came earlier
/// @audit function `totalSupplyAt` came earlier
/// @audit function `totalSupplyLockedAtT` came earlier
/// @audit function `totalSupplyLocked` came earlier
/// @audit function `getPastTotalSupply` came earlier
/// @audit function `supportsInterface` came earlier
/// @audit function `allowance` came earlier
/// @audit function `delegates` came earlier
136:     string public constant name = "Voting Escrow OLAS";

/// @audit event/error `ZeroAddress` came earlier
/// @audit event/error `WrongTimestamp` came earlier
/// @audit event/error `ImplementedIn` came earlier
/// @audit event/error `NonTransferable` came earlier
/// @audit event/error `NonDelegatable` came earlier
/// @audit function `totalNumPoints` came earlier
/// @audit function `mapSupplyPoints` came earlier
/// @audit function `mapSlopeChanges` came earlier
/// @audit function `getLastUserPoint` came earlier
/// @audit function `getNumUserPoints` came earlier
/// @audit function `getUserPoint` came earlier
/// @audit function `getPastVotes` came earlier
/// @audit function `balanceOf` came earlier
/// @audit function `balanceOfAt` came earlier
/// @audit function `lockedEnd` came earlier
/// @audit function `getVotes` came earlier
/// @audit function `totalSupply` came earlier
/// @audit function `totalSupplyAt` came earlier
/// @audit function `totalSupplyLockedAtT` came earlier
/// @audit function `totalSupplyLocked` came earlier
/// @audit function `getPastTotalSupply` came earlier
/// @audit function `supportsInterface` came earlier
/// @audit function `allowance` came earlier
/// @audit function `delegates` came earlier
138:     string public constant symbol = "veOLAS";

/// @audit event/error `ZeroAddress` came earlier
/// @audit event/error `WrongTimestamp` came earlier
/// @audit event/error `ImplementedIn` came earlier
/// @audit event/error `NonTransferable` came earlier
/// @audit event/error `NonDelegatable` came earlier
/// @audit function `totalNumPoints` came earlier
/// @audit function `mapSupplyPoints` came earlier
/// @audit function `mapSlopeChanges` came earlier
/// @audit function `getLastUserPoint` came earlier
/// @audit function `getNumUserPoints` came earlier
/// @audit function `getUserPoint` came earlier
/// @audit function `getPastVotes` came earlier
/// @audit function `balanceOf` came earlier
/// @audit function `balanceOfAt` came earlier
/// @audit function `lockedEnd` came earlier
/// @audit function `getVotes` came earlier
/// @audit function `totalSupply` came earlier
/// @audit function `totalSupplyAt` came earlier
/// @audit function `totalSupplyLockedAtT` came earlier
/// @audit function `totalSupplyLocked` came earlier
/// @audit function `getPastTotalSupply` came earlier
/// @audit function `supportsInterface` came earlier
/// @audit function `allowance` came earlier
/// @audit function `delegates` came earlier
140:     uint8 public constant decimals = 18;

Github: [108, 113, 117, 121, 125, 132, 134, 136, 138, 140]

File: registries/contracts/GenericManager.sol

/// @audit event/error `OwnerUpdated` came earlier
/// @audit event/error `Pause` came earlier
/// @audit event/error `Unpause` came earlier
14:     address public owner;

/// @audit event/error `OwnerUpdated` came earlier
/// @audit event/error `Pause` came earlier
/// @audit event/error `Unpause` came earlier
16:     bool public paused;

Github: [14, 16]

File: registries/contracts/GenericRegistry.sol

/// @audit event/error `OwnerUpdated` came earlier
/// @audit event/error `ManagerUpdated` came earlier
/// @audit event/error `BaseURIChanged` came earlier
15:     address public owner;

/// @audit event/error `OwnerUpdated` came earlier
/// @audit event/error `ManagerUpdated` came earlier
/// @audit event/error `BaseURIChanged` came earlier
17:     address public manager;

/// @audit event/error `OwnerUpdated` came earlier
/// @audit event/error `ManagerUpdated` came earlier
/// @audit event/error `BaseURIChanged` came earlier
19:     string public baseURI;

/// @audit event/error `OwnerUpdated` came earlier
/// @audit event/error `ManagerUpdated` came earlier
/// @audit event/error `BaseURIChanged` came earlier
21:     uint256 public totalSupply;

/// @audit event/error `OwnerUpdated` came earlier
/// @audit event/error `ManagerUpdated` came earlier
/// @audit event/error `BaseURIChanged` came earlier
23:     uint256 internal _locked = 1;

/// @audit event/error `OwnerUpdated` came earlier
/// @audit event/error `ManagerUpdated` came earlier
/// @audit event/error `BaseURIChanged` came earlier
33:     string public constant CID_PREFIX = "f01701220";

Github: [15, 17, 19, 21, 23, 33]

File: registries/contracts/UnitRegistry.sol

/// @audit event/error `CreateUnit` came earlier
/// @audit event/error `UpdateUnitHash` came earlier
12:     enum UnitType {

/// @audit event/error `CreateUnit` came earlier
/// @audit event/error `UpdateUnitHash` came earlier
18:     struct Unit {

/// @audit event/error `CreateUnit` came earlier
/// @audit event/error `UpdateUnitHash` came earlier
27:     UnitType public immutable unitType;

/// @audit event/error `CreateUnit` came earlier
/// @audit event/error `UpdateUnitHash` came earlier
29:     mapping(uint256 => bytes32[]) public mapUnitIdHashes;

/// @audit event/error `CreateUnit` came earlier
/// @audit event/error `UpdateUnitHash` came earlier
31:     mapping(uint256 => uint32[]) public mapSubComponents;

/// @audit event/error `CreateUnit` came earlier
/// @audit event/error `UpdateUnitHash` came earlier
33:     mapping(uint256 => Unit) public mapUnits;

Github: [12, 18, 27, 29, 31, 33]

File: registries/contracts/multisigs/GnosisSafeMultisig.sol

/// @audit function `createProxyWithNonce` came earlier
20: error IncorrectDataLength(uint256 expected, uint256 provided);

/// @audit event/error `IncorrectDataLength` came earlier
/// @audit function `createProxyWithNonce` came earlier
26:     bytes4 public constant GNOSIS_SAFE_SETUP_SELECTOR = 0xb63e800d;

/// @audit event/error `IncorrectDataLength` came earlier
/// @audit function `createProxyWithNonce` came earlier
28:     uint256 public constant DEFAULT_DATA_LENGTH = 144;

/// @audit event/error `IncorrectDataLength` came earlier
/// @audit function `createProxyWithNonce` came earlier
30:     address payable public immutable gnosisSafe;

/// @audit event/error `IncorrectDataLength` came earlier
/// @audit function `createProxyWithNonce` came earlier
32:     address public immutable gnosisSafeProxyFactory;

Github: [20, 26, 28, 30, 32]

File: registries/contracts/multisigs/GnosisSafeSameAddressMultisig.sol

/// @audit function `getOwners` came earlier
/// @audit function `getThreshold` came earlier
16: error ZeroValue();

/// @audit function `getOwners` came earlier
/// @audit function `getThreshold` came earlier
19: error ZeroAddress();

/// @audit function `getOwners` came earlier
/// @audit function `getThreshold` came earlier
23: error UnauthorizedMultisig(address multisig);

/// @audit function `getOwners` came earlier
/// @audit function `getThreshold` came earlier
28: error IncorrectDataLength(uint256 expected, uint256 provided);

/// @audit function `getOwners` came earlier
/// @audit function `getThreshold` came earlier
33: error WrongThreshold(uint256 expected, uint256 provided);

/// @audit function `getOwners` came earlier
/// @audit function `getThreshold` came earlier
38: error WrongNumOwners(uint256 expected, uint256 provided);

/// @audit function `getOwners` came earlier
/// @audit function `getThreshold` came earlier
42: error WrongOwner(address provided);

/// @audit function `getOwners` came earlier
/// @audit function `getThreshold` came earlier
46: error MultisigExecFailed(address provided);

/// @audit event/error `ZeroValue` came earlier
/// @audit event/error `ZeroAddress` came earlier
/// @audit event/error `UnauthorizedMultisig` came earlier
/// @audit event/error `IncorrectDataLength` came earlier
/// @audit event/error `WrongThreshold` came earlier
/// @audit event/error `WrongNumOwners` came earlier
/// @audit event/error `WrongOwner` came earlier
/// @audit event/error `MultisigExecFailed` came earlier
/// @audit function `getOwners` came earlier
/// @audit function `getThreshold` came earlier
53:     uint256 public constant DEFAULT_DATA_LENGTH = 20;

/// @audit event/error `ZeroValue` came earlier
/// @audit event/error `ZeroAddress` came earlier
/// @audit event/error `UnauthorizedMultisig` came earlier
/// @audit event/error `IncorrectDataLength` came earlier
/// @audit event/error `WrongThreshold` came earlier
/// @audit event/error `WrongNumOwners` came earlier
/// @audit event/error `WrongOwner` came earlier
/// @audit event/error `MultisigExecFailed` came earlier
/// @audit function `getOwners` came earlier
/// @audit function `getThreshold` came earlier
56:     bytes32 public immutable proxyHash;

Github: [16, 19, 23, 28, 33, 38, 42, 46, 53, 56]

File: tokenomics/contracts/Depository.sol

/// @audit event/error `OwnerUpdated` came earlier
/// @audit event/error `TokenomicsUpdated` came earlier
/// @audit event/error `TreasuryUpdated` came earlier
/// @audit event/error `BondCalculatorUpdated` came earlier
/// @audit event/error `CreateBond` came earlier
/// @audit event/error `RedeemBond` came earlier
/// @audit event/error `CreateProduct` came earlier
/// @audit event/error `CloseProduct` came earlier
75:     uint256 public constant MIN_VESTING = 1 days;

/// @audit event/error `OwnerUpdated` came earlier
/// @audit event/error `TokenomicsUpdated` came earlier
/// @audit event/error `TreasuryUpdated` came earlier
/// @audit event/error `BondCalculatorUpdated` came earlier
/// @audit event/error `CreateBond` came earlier
/// @audit event/error `RedeemBond` came earlier
/// @audit event/error `CreateProduct` came earlier
/// @audit event/error `CloseProduct` came earlier
77:     string public constant VERSION = "1.0.1";

/// @audit event/error `OwnerUpdated` came earlier
/// @audit event/error `TokenomicsUpdated` came earlier
/// @audit event/error `TreasuryUpdated` came earlier
/// @audit event/error `BondCalculatorUpdated` came earlier
/// @audit event/error `CreateBond` came earlier
/// @audit event/error `RedeemBond` came earlier
/// @audit event/error `CreateProduct` came earlier
/// @audit event/error `CloseProduct` came earlier
80:     address public owner;

/// @audit event/error `OwnerUpdated` came earlier
/// @audit event/error `TokenomicsUpdated` came earlier
/// @audit event/error `TreasuryUpdated` came earlier
/// @audit event/error `BondCalculatorUpdated` came earlier
/// @audit event/error `CreateBond` came earlier
/// @audit event/error `RedeemBond` came earlier
/// @audit event/error `CreateProduct` came earlier
/// @audit event/error `CloseProduct` came earlier
83:     uint32 public bondCounter;

/// @audit event/error `OwnerUpdated` came earlier
/// @audit event/error `TokenomicsUpdated` came earlier
/// @audit event/error `TreasuryUpdated` came earlier
/// @audit event/error `BondCalculatorUpdated` came earlier
/// @audit event/error `CreateBond` came earlier
/// @audit event/error `RedeemBond` came earlier
/// @audit event/error `CreateProduct` came earlier
/// @audit event/error `CloseProduct` came earlier
86:     uint32 public productCounter;

/// @audit event/error `OwnerUpdated` came earlier
/// @audit event/error `TokenomicsUpdated` came earlier
/// @audit event/error `TreasuryUpdated` came earlier
/// @audit event/error `BondCalculatorUpdated` came earlier
/// @audit event/error `CreateBond` came earlier
/// @audit event/error `RedeemBond` came earlier
/// @audit event/error `CreateProduct` came earlier
/// @audit event/error `CloseProduct` came earlier
89:     address public immutable olas;

/// @audit event/error `OwnerUpdated` came earlier
/// @audit event/error `TokenomicsUpdated` came earlier
/// @audit event/error `TreasuryUpdated` came earlier
/// @audit event/error `BondCalculatorUpdated` came earlier
/// @audit event/error `CreateBond` came earlier
/// @audit event/error `RedeemBond` came earlier
/// @audit event/error `CreateProduct` came earlier
/// @audit event/error `CloseProduct` came earlier
91:     address public tokenomics;

/// @audit event/error `OwnerUpdated` came earlier
/// @audit event/error `TokenomicsUpdated` came earlier
/// @audit event/error `TreasuryUpdated` came earlier
/// @audit event/error `BondCalculatorUpdated` came earlier
/// @audit event/error `CreateBond` came earlier
/// @audit event/error `RedeemBond` came earlier
/// @audit event/error `CreateProduct` came earlier
/// @audit event/error `CloseProduct` came earlier
93:     address public treasury;

/// @audit event/error `OwnerUpdated` came earlier
/// @audit event/error `TokenomicsUpdated` came earlier
/// @audit event/error `TreasuryUpdated` came earlier
/// @audit event/error `BondCalculatorUpdated` came earlier
/// @audit event/error `CreateBond` came earlier
/// @audit event/error `RedeemBond` came earlier
/// @audit event/error `CreateProduct` came earlier
/// @audit event/error `CloseProduct` came earlier
95:     address public bondCalculator;

/// @audit event/error `OwnerUpdated` came earlier
/// @audit event/error `TokenomicsUpdated` came earlier
/// @audit event/error `TreasuryUpdated` came earlier
/// @audit event/error `BondCalculatorUpdated` came earlier
/// @audit event/error `CreateBond` came earlier
/// @audit event/error `RedeemBond` came earlier
/// @audit event/error `CreateProduct` came earlier
/// @audit event/error `CloseProduct` came earlier
98:     mapping(uint256 => Bond) public mapUserBonds;

/// @audit event/error `OwnerUpdated` came earlier
/// @audit event/error `TokenomicsUpdated` came earlier
/// @audit event/error `TreasuryUpdated` came earlier
/// @audit event/error `BondCalculatorUpdated` came earlier
/// @audit event/error `CreateBond` came earlier
/// @audit event/error `RedeemBond` came earlier
/// @audit event/error `CreateProduct` came earlier
/// @audit event/error `CloseProduct` came earlier
100:     mapping(uint256 => Product) public mapBondProducts;

Github: [75, 77, 80, 83, 86, 89, 91, 93, 95, 98, 100]

File: tokenomics/contracts/Dispenser.sol

/// @audit event/error `OwnerUpdated` came earlier
/// @audit event/error `TokenomicsUpdated` came earlier
/// @audit event/error `TreasuryUpdated` came earlier
/// @audit event/error `IncentivesClaimed` came earlier
18:     address public owner;

/// @audit event/error `OwnerUpdated` came earlier
/// @audit event/error `TokenomicsUpdated` came earlier
/// @audit event/error `TreasuryUpdated` came earlier
/// @audit event/error `IncentivesClaimed` came earlier
20:     uint8 internal _locked;

/// @audit event/error `OwnerUpdated` came earlier
/// @audit event/error `TokenomicsUpdated` came earlier
/// @audit event/error `TreasuryUpdated` came earlier
/// @audit event/error `IncentivesClaimed` came earlier
23:     address public tokenomics;

/// @audit event/error `OwnerUpdated` came earlier
/// @audit event/error `TokenomicsUpdated` came earlier
/// @audit event/error `TreasuryUpdated` came earlier
/// @audit event/error `IncentivesClaimed` came earlier
25:     address public treasury;

Github: [18, 20, 23, 25]

File: tokenomics/contracts/DonatorBlacklist.sol

/// @audit event/error `OwnerUpdated` came earlier
/// @audit event/error `DonatorBlacklistStatus` came earlier
/// @audit event/error `OwnerOnly` came earlier
/// @audit event/error `ZeroAddress` came earlier
/// @audit event/error `WrongArrayLength` came earlier
25:     address public owner;

/// @audit event/error `OwnerUpdated` came earlier
/// @audit event/error `DonatorBlacklistStatus` came earlier
/// @audit event/error `OwnerOnly` came earlier
/// @audit event/error `ZeroAddress` came earlier
/// @audit event/error `WrongArrayLength` came earlier
27:     mapping(address => bool) public mapBlacklistedDonators;

Github: [25, 27]

File: tokenomics/contracts/GenericBondCalculator.sol

/// @audit event/error `Overflow` came earlier
/// @audit event/error `ZeroAddress` came earlier
22:     address public immutable olas;

/// @audit event/error `Overflow` came earlier
/// @audit event/error `ZeroAddress` came earlier
24:     address public immutable tokenomics;

Github: [22, 24]

File: tokenomics/contracts/Tokenomics.sol

/// @audit event/error `OwnerUpdated` came earlier
/// @audit event/error `TreasuryUpdated` came earlier
/// @audit event/error `DepositoryUpdated` came earlier
/// @audit event/error `DispenserUpdated` came earlier
/// @audit event/error `EpochLengthUpdated` came earlier
/// @audit event/error `EffectiveBondUpdated` came earlier
/// @audit event/error `IDFUpdated` came earlier
/// @audit event/error `TokenomicsParametersUpdateRequested` came earlier
/// @audit event/error `TokenomicsParametersUpdated` came earlier
/// @audit event/error `IncentiveFractionsUpdateRequested` came earlier
/// @audit event/error `IncentiveFractionsUpdated` came earlier
/// @audit event/error `ComponentRegistryUpdated` came earlier
/// @audit event/error `AgentRegistryUpdated` came earlier
/// @audit event/error `ServiceRegistryUpdated` came earlier
/// @audit event/error `DonatorBlacklistUpdated` came earlier
/// @audit event/error `EpochSettled` came earlier
/// @audit event/error `TokenomicsImplementationUpdated` came earlier
140:     address public owner;

/// @audit event/error `OwnerUpdated` came earlier
/// @audit event/error `TreasuryUpdated` came earlier
/// @audit event/error `DepositoryUpdated` came earlier
/// @audit event/error `DispenserUpdated` came earlier
/// @audit event/error `EpochLengthUpdated` came earlier
/// @audit event/error `EffectiveBondUpdated` came earlier
/// @audit event/error `IDFUpdated` came earlier
/// @audit event/error `TokenomicsParametersUpdateRequested` came earlier
/// @audit event/error `TokenomicsParametersUpdated` came earlier
/// @audit event/error `IncentiveFractionsUpdateRequested` came earlier
/// @audit event/error `IncentiveFractionsUpdated` came earlier
/// @audit event/error `ComponentRegistryUpdated` came earlier
/// @audit event/error `AgentRegistryUpdated` came earlier
/// @audit event/error `ServiceRegistryUpdated` came earlier
/// @audit event/error `DonatorBlacklistUpdated` came earlier
/// @audit event/error `EpochSettled` came earlier
/// @audit event/error `TokenomicsImplementationUpdated` came earlier
143:     uint96 public maxBond;

/// @audit event/error `OwnerUpdated` came earlier
/// @audit event/error `TreasuryUpdated` came earlier
/// @audit event/error `DepositoryUpdated` came earlier
/// @audit event/error `DispenserUpdated` came earlier
/// @audit event/error `EpochLengthUpdated` came earlier
/// @audit event/error `EffectiveBondUpdated` came earlier
/// @audit event/error `IDFUpdated` came earlier
/// @audit event/error `TokenomicsParametersUpdateRequested` came earlier
/// @audit event/error `TokenomicsParametersUpdated` came earlier
/// @audit event/error `IncentiveFractionsUpdateRequested` came earlier
/// @audit event/error `IncentiveFractionsUpdated` came earlier
/// @audit event/error `ComponentRegistryUpdated` came earlier
/// @audit event/error `AgentRegistryUpdated` came earlier
/// @audit event/error `ServiceRegistryUpdated` came earlier
/// @audit event/error `DonatorBlacklistUpdated` came earlier
/// @audit event/error `EpochSettled` came earlier
/// @audit event/error `TokenomicsImplementationUpdated` came earlier
146:     address public olas;

/// @audit event/error `OwnerUpdated` came earlier
/// @audit event/error `TreasuryUpdated` came earlier
/// @audit event/error `DepositoryUpdated` came earlier
/// @audit event/error `DispenserUpdated` came earlier
/// @audit event/error `EpochLengthUpdated` came earlier
/// @audit event/error `EffectiveBondUpdated` came earlier
/// @audit event/error `IDFUpdated` came earlier
/// @audit event/error `TokenomicsParametersUpdateRequested` came earlier
/// @audit event/error `TokenomicsParametersUpdated` came earlier
/// @audit event/error `IncentiveFractionsUpdateRequested` came earlier
/// @audit event/error `IncentiveFractionsUpdated` came earlier
/// @audit event/error `ComponentRegistryUpdated` came earlier
/// @audit event/error `AgentRegistryUpdated` came earlier
/// @audit event/error `ServiceRegistryUpdated` came earlier
/// @audit event/error `DonatorBlacklistUpdated` came earlier
/// @audit event/error `EpochSettled` came earlier
/// @audit event/error `TokenomicsImplementationUpdated` came earlier
148:     uint96 public inflationPerSecond;

/// @audit event/error `OwnerUpdated` came earlier
/// @audit event/error `TreasuryUpdated` came earlier
/// @audit event/error `DepositoryUpdated` came earlier
/// @audit event/error `DispenserUpdated` came earlier
/// @audit event/error `EpochLengthUpdated` came earlier
/// @audit event/error `EffectiveBondUpdated` came earlier
/// @audit event/error `IDFUpdated` came earlier
/// @audit event/error `TokenomicsParametersUpdateRequested` came earlier
/// @audit event/error `TokenomicsParametersUpdated` came earlier
/// @audit event/error `IncentiveFractionsUpdateRequested` came earlier
/// @audit event/error `IncentiveFractionsUpdated` came earlier
/// @audit event/error `ComponentRegistryUpdated` came earlier
/// @audit event/error `AgentRegistryUpdated` came earlier
/// @audit event/error `ServiceRegistryUpdated` came earlier
/// @audit event/error `DonatorBlacklistUpdated` came earlier
/// @audit event/error `EpochSettled` came earlier
/// @audit event/error `TokenomicsImplementationUpdated` came earlier
151:     address public treasury;

/// @audit event/error `OwnerUpdated` came earlier
/// @audit event/error `TreasuryUpdated` came earlier
/// @audit event/error `DepositoryUpdated` came earlier
/// @audit event/error `DispenserUpdated` came earlier
/// @audit event/error `EpochLengthUpdated` came earlier
/// @audit event/error `EffectiveBondUpdated` came earlier
/// @audit event/error `IDFUpdated` came earlier
/// @audit event/error `TokenomicsParametersUpdateRequested` came earlier
/// @audit event/error `TokenomicsParametersUpdated` came earlier
/// @audit event/error `IncentiveFractionsUpdateRequested` came earlier
/// @audit event/error `IncentiveFractionsUpdated` came earlier
/// @audit event/error `ComponentRegistryUpdated` came earlier
/// @audit event/error `AgentRegistryUpdated` came earlier
/// @audit event/error `ServiceRegistryUpdated` came earlier
/// @audit event/error `DonatorBlacklistUpdated` came earlier
/// @audit event/error `EpochSettled` came earlier
/// @audit event/error `TokenomicsImplementationUpdated` came earlier
154:     uint96 public veOLASThreshold;

/// @audit event/error `OwnerUpdated` came earlier
/// @audit event/error `TreasuryUpdated` came earlier
/// @audit event/error `DepositoryUpdated` came earlier
/// @audit event/error `DispenserUpdated` came earlier
/// @audit event/error `EpochLengthUpdated` came earlier
/// @audit event/error `EffectiveBondUpdated` came earlier
/// @audit event/error `IDFUpdated` came earlier
/// @audit event/error `TokenomicsParametersUpdateRequested` came earlier
/// @audit event/error `TokenomicsParametersUpdated` came earlier
/// @audit event/error `IncentiveFractionsUpdateRequested` came earlier
/// @audit event/error `IncentiveFractionsUpdated` came earlier
/// @audit event/error `ComponentRegistryUpdated` came earlier
/// @audit event/error `AgentRegistryUpdated` came earlier
/// @audit event/error `ServiceRegistryUpdated` came earlier
/// @audit event/error `DonatorBlacklistUpdated` came earlier
/// @audit event/error `EpochSettled` came earlier
/// @audit event/error `TokenomicsImplementationUpdated` came earlier
157:     address public depository;

/// @audit event/error `OwnerUpdated` came earlier
/// @audit event/error `TreasuryUpdated` came earlier
/// @audit event/error `DepositoryUpdated` came earlier
/// @audit event/error `DispenserUpdated` came earlier
/// @audit event/error `EpochLengthUpdated` came earlier
/// @audit event/error `EffectiveBondUpdated` came earlier
/// @audit event/error `IDFUpdated` came earlier
/// @audit event/error `TokenomicsParametersUpdateRequested` came earlier
/// @audit event/error `TokenomicsParametersUpdated` came earlier
/// @audit event/error `IncentiveFractionsUpdateRequested` came earlier
/// @audit event/error `IncentiveFractionsUpdated` came earlier
/// @audit event/error `ComponentRegistryUpdated` came earlier
/// @audit event/error `AgentRegistryUpdated` came earlier
/// @audit event/error `ServiceRegistryUpdated` came earlier
/// @audit event/error `DonatorBlacklistUpdated` came earlier
/// @audit event/error `EpochSettled` came earlier
/// @audit event/error `TokenomicsImplementationUpdated` came earlier
161:     uint96 public effectiveBond;

/// @audit event/error `OwnerUpdated` came earlier
/// @audit event/error `TreasuryUpdated` came earlier
/// @audit event/error `DepositoryUpdated` came earlier
/// @audit event/error `DispenserUpdated` came earlier
/// @audit event/error `EpochLengthUpdated` came earlier
/// @audit event/error `EffectiveBondUpdated` came earlier
/// @audit event/error `IDFUpdated` came earlier
/// @audit event/error `TokenomicsParametersUpdateRequested` came earlier
/// @audit event/error `TokenomicsParametersUpdated` came earlier
/// @audit event/error `IncentiveFractionsUpdateRequested` came earlier
/// @audit event/error `IncentiveFractionsUpdated` came earlier
/// @audit event/error `ComponentRegistryUpdated` came earlier
/// @audit event/error `AgentRegistryUpdated` came earlier
/// @audit event/error `ServiceRegistryUpdated` came earlier
/// @audit event/error `DonatorBlacklistUpdated` came earlier
/// @audit event/error `EpochSettled` came earlier
/// @audit event/error `TokenomicsImplementationUpdated` came earlier
164:     address public dispenser;

/// @audit event/error `OwnerUpdated` came earlier
/// @audit event/error `TreasuryUpdated` came earlier
/// @audit event/error `DepositoryUpdated` came earlier
/// @audit event/error `DispenserUpdated` came earlier
/// @audit event/error `EpochLengthUpdated` came earlier
/// @audit event/error `EffectiveBondUpdated` came earlier
/// @audit event/error `IDFUpdated` came earlier
/// @audit event/error `TokenomicsParametersUpdateRequested` came earlier
/// @audit event/error `TokenomicsParametersUpdated` came earlier
/// @audit event/error `IncentiveFractionsUpdateRequested` came earlier
/// @audit event/error `IncentiveFractionsUpdated` came earlier
/// @audit event/error `ComponentRegistryUpdated` came earlier
/// @audit event/error `AgentRegistryUpdated` came earlier
/// @audit event/error `ServiceRegistryUpdated` came earlier
/// @audit event/error `DonatorBlacklistUpdated` came earlier
/// @audit event/error `EpochSettled` came earlier
/// @audit event/error `TokenomicsImplementationUpdated` came earlier
167:     uint72 public codePerDev;

/// @audit event/error `OwnerUpdated` came earlier
/// @audit event/error `TreasuryUpdated` came earlier
/// @audit event/error `DepositoryUpdated` came earlier
/// @audit event/error `DispenserUpdated` came earlier
/// @audit event/error `EpochLengthUpdated` came earlier
/// @audit event/error `EffectiveBondUpdated` came earlier
/// @audit event/error `IDFUpdated` came earlier
/// @audit event/error `TokenomicsParametersUpdateRequested` came earlier
/// @audit event/error `TokenomicsParametersUpdated` came earlier
/// @audit event/error `IncentiveFractionsUpdateRequested` came earlier
/// @audit event/error `IncentiveFractionsUpdated` came earlier
/// @audit event/error `ComponentRegistryUpdated` came earlier
/// @audit event/error `AgentRegistryUpdated` came earlier
/// @audit event/error `ServiceRegistryUpdated` came earlier
/// @audit event/error `DonatorBlacklistUpdated` came earlier
/// @audit event/error `EpochSettled` came earlier
/// @audit event/error `TokenomicsImplementationUpdated` came earlier
170:     uint8 public currentYear;

/// @audit event/error `OwnerUpdated` came earlier
/// @audit event/error `TreasuryUpdated` came earlier
/// @audit event/error `DepositoryUpdated` came earlier
/// @audit event/error `DispenserUpdated` came earlier
/// @audit event/error `EpochLengthUpdated` came earlier
/// @audit event/error `EffectiveBondUpdated` came earlier
/// @audit event/error `IDFUpdated` came earlier
/// @audit event/error `TokenomicsParametersUpdateRequested` came earlier
/// @audit event/error `TokenomicsParametersUpdated` came earlier
/// @audit event/error `IncentiveFractionsUpdateRequested` came earlier
/// @audit event/error `IncentiveFractionsUpdated` came earlier
/// @audit event/error `ComponentRegistryUpdated` came earlier
/// @audit event/error `AgentRegistryUpdated` came earlier
/// @audit event/error `ServiceRegistryUpdated` came earlier
/// @audit event/error `DonatorBlacklistUpdated` came earlier
/// @audit event/error `EpochSettled` came earlier
/// @audit event/error `TokenomicsImplementationUpdated` came earlier
172:     bytes1 public tokenomicsParametersUpdated;

/// @audit event/error `OwnerUpdated` came earlier
/// @audit event/error `TreasuryUpdated` came earlier
/// @audit event/error `DepositoryUpdated` came earlier
/// @audit event/error `DispenserUpdated` came earlier
/// @audit event/error `EpochLengthUpdated` came earlier
/// @audit event/error `EffectiveBondUpdated` came earlier
/// @audit event/error `IDFUpdated` came earlier
/// @audit event/error `TokenomicsParametersUpdateRequested` came earlier
/// @audit event/error `TokenomicsParametersUpdated` came earlier
/// @audit event/error `IncentiveFractionsUpdateRequested` came earlier
/// @audit event/error `IncentiveFractionsUpdated` came earlier
/// @audit event/error `ComponentRegistryUpdated` came earlier
/// @audit event/error `AgentRegistryUpdated` came earlier
/// @audit event/error `ServiceRegistryUpdated` came earlier
/// @audit event/error `DonatorBlacklistUpdated` came earlier
/// @audit event/error `EpochSettled` came earlier
/// @audit event/error `TokenomicsImplementationUpdated` came earlier
174:     uint8 internal _locked;

/// @audit event/error `OwnerUpdated` came earlier
/// @audit event/error `TreasuryUpdated` came earlier
/// @audit event/error `DepositoryUpdated` came earlier
/// @audit event/error `DispenserUpdated` came earlier
/// @audit event/error `EpochLengthUpdated` came earlier
/// @audit event/error `EffectiveBondUpdated` came earlier
/// @audit event/error `IDFUpdated` came earlier
/// @audit event/error `TokenomicsParametersUpdateRequested` came earlier
/// @audit event/error `TokenomicsParametersUpdated` came earlier
/// @audit event/error `IncentiveFractionsUpdateRequested` came earlier
/// @audit event/error `IncentiveFractionsUpdated` came earlier
/// @audit event/error `ComponentRegistryUpdated` came earlier
/// @audit event/error `AgentRegistryUpdated` came earlier
/// @audit event/error `ServiceRegistryUpdated` came earlier
/// @audit event/error `DonatorBlacklistUpdated` came earlier
/// @audit event/error `EpochSettled` came earlier
/// @audit event/error `TokenomicsImplementationUpdated` came earlier
177:     address public componentRegistry;

/// @audit event/error `OwnerUpdated` came earlier
/// @audit event/error `TreasuryUpdated` came earlier
/// @audit event/error `DepositoryUpdated` came earlier
/// @audit event/error `DispenserUpdated` came earlier
/// @audit event/error `EpochLengthUpdated` came earlier
/// @audit event/error `EffectiveBondUpdated` came earlier
/// @audit event/error `IDFUpdated` came earlier
/// @audit event/error `TokenomicsParametersUpdateRequested` came earlier
/// @audit event/error `TokenomicsParametersUpdated` came earlier
/// @audit event/error `IncentiveFractionsUpdateRequested` came earlier
/// @audit event/error `IncentiveFractionsUpdated` came earlier
/// @audit event/error `ComponentRegistryUpdated` came earlier
/// @audit event/error `AgentRegistryUpdated` came earlier
/// @audit event/error `ServiceRegistryUpdated` came earlier
/// @audit event/error `DonatorBlacklistUpdated` came earlier
/// @audit event/error `EpochSettled` came earlier
/// @audit event/error `TokenomicsImplementationUpdated` came earlier
181:     uint64 public epsilonRate;

/// @audit event/error `OwnerUpdated` came earlier
/// @audit event/error `TreasuryUpdated` came earlier
/// @audit event/error `DepositoryUpdated` came earlier
/// @audit event/error `DispenserUpdated` came earlier
/// @audit event/error `EpochLengthUpdated` came earlier
/// @audit event/error `EffectiveBondUpdated` came earlier
/// @audit event/error `IDFUpdated` came earlier
/// @audit event/error `TokenomicsParametersUpdateRequested` came earlier
/// @audit event/error `TokenomicsParametersUpdated` came earlier
/// @audit event/error `IncentiveFractionsUpdateRequested` came earlier
/// @audit event/error `IncentiveFractionsUpdated` came earlier
/// @audit event/error `ComponentRegistryUpdated` came earlier
/// @audit event/error `AgentRegistryUpdated` came earlier
/// @audit event/error `ServiceRegistryUpdated` came earlier
/// @audit event/error `DonatorBlacklistUpdated` came earlier
/// @audit event/error `EpochSettled` came earlier
/// @audit event/error `TokenomicsImplementationUpdated` came earlier
184:     uint32 public epochLen;

/// @audit event/error `OwnerUpdated` came earlier
/// @audit event/error `TreasuryUpdated` came earlier
/// @audit event/error `DepositoryUpdated` came earlier
/// @audit event/error `DispenserUpdated` came earlier
/// @audit event/error `EpochLengthUpdated` came earlier
/// @audit event/error `EffectiveBondUpdated` came earlier
/// @audit event/error `IDFUpdated` came earlier
/// @audit event/error `TokenomicsParametersUpdateRequested` came earlier
/// @audit event/error `TokenomicsParametersUpdated` came earlier
/// @audit event/error `IncentiveFractionsUpdateRequested` came earlier
/// @audit event/error `IncentiveFractionsUpdated` came earlier
/// @audit event/error `ComponentRegistryUpdated` came earlier
/// @audit event/error `AgentRegistryUpdated` came earlier
/// @audit event/error `ServiceRegistryUpdated` came earlier
/// @audit event/error `DonatorBlacklistUpdated` came earlier
/// @audit event/error `EpochSettled` came earlier
/// @audit event/error `TokenomicsImplementationUpdated` came earlier
187:     address public agentRegistry;

/// @audit event/error `OwnerUpdated` came earlier
/// @audit event/error `TreasuryUpdated` came earlier
/// @audit event/error `DepositoryUpdated` came earlier
/// @audit event/error `DispenserUpdated` came earlier
/// @audit event/error `EpochLengthUpdated` came earlier
/// @audit event/error `EffectiveBondUpdated` came earlier
/// @audit event/error `IDFUpdated` came earlier
/// @audit event/error `TokenomicsParametersUpdateRequested` came earlier
/// @audit event/error `TokenomicsParametersUpdated` came earlier
/// @audit event/error `IncentiveFractionsUpdateRequested` came earlier
/// @audit event/error `IncentiveFractionsUpdated` came earlier
/// @audit event/error `ComponentRegistryUpdated` came earlier
/// @audit event/error `AgentRegistryUpdated` came earlier
/// @audit event/error `ServiceRegistryUpdated` came earlier
/// @audit event/error `DonatorBlacklistUpdated` came earlier
/// @audit event/error `EpochSettled` came earlier
/// @audit event/error `TokenomicsImplementationUpdated` came earlier
190:     uint96 public nextVeOLASThreshold;

/// @audit event/error `OwnerUpdated` came earlier
/// @audit event/error `TreasuryUpdated` came earlier
/// @audit event/error `DepositoryUpdated` came earlier
/// @audit event/error `DispenserUpdated` came earlier
/// @audit event/error `EpochLengthUpdated` came earlier
/// @audit event/error `EffectiveBondUpdated` came earlier
/// @audit event/error `IDFUpdated` came earlier
/// @audit event/error `TokenomicsParametersUpdateRequested` came earlier
/// @audit event/error `TokenomicsParametersUpdated` came earlier
/// @audit event/error `IncentiveFractionsUpdateRequested` came earlier
/// @audit event/error `IncentiveFractionsUpdated` came earlier
/// @audit event/error `ComponentRegistryUpdated` came earlier
/// @audit event/error `AgentRegistryUpdated` came earlier
/// @audit event/error `ServiceRegistryUpdated` came earlier
/// @audit event/error `DonatorBlacklistUpdated` came earlier
/// @audit event/error `EpochSettled` came earlier
/// @audit event/error `TokenomicsImplementationUpdated` came earlier
193:     address public serviceRegistry;

/// @audit event/error `OwnerUpdated` came earlier
/// @audit event/error `TreasuryUpdated` came earlier
/// @audit event/error `DepositoryUpdated` came earlier
/// @audit event/error `DispenserUpdated` came earlier
/// @audit event/error `EpochLengthUpdated` came earlier
/// @audit event/error `EffectiveBondUpdated` came earlier
/// @audit event/error `IDFUpdated` came earlier
/// @audit event/error `TokenomicsParametersUpdateRequested` came earlier
/// @audit event/error `TokenomicsParametersUpdated` came earlier
/// @audit event/error `IncentiveFractionsUpdateRequested` came earlier
/// @audit event/error `IncentiveFractionsUpdated` came earlier
/// @audit event/error `ComponentRegistryUpdated` came earlier
/// @audit event/error `AgentRegistryUpdated` came earlier
/// @audit event/error `ServiceRegistryUpdated` came earlier
/// @audit event/error `DonatorBlacklistUpdated` came earlier
/// @audit event/error `EpochSettled` came earlier
/// @audit event/error `TokenomicsImplementationUpdated` came earlier
196:     uint32 public epochCounter;

/// @audit event/error `OwnerUpdated` came earlier
/// @audit event/error `TreasuryUpdated` came earlier
/// @audit event/error `DepositoryUpdated` came earlier
/// @audit event/error `DispenserUpdated` came earlier
/// @audit event/error `EpochLengthUpdated` came earlier
/// @audit event/error `EffectiveBondUpdated` came earlier
/// @audit event/error `IDFUpdated` came earlier
/// @audit event/error `TokenomicsParametersUpdateRequested` came earlier
/// @audit event/error `TokenomicsParametersUpdated` came earlier
/// @audit event/error `IncentiveFractionsUpdateRequested` came earlier
/// @audit event/error `IncentiveFractionsUpdated` came earlier
/// @audit event/error `ComponentRegistryUpdated` came earlier
/// @audit event/error `AgentRegistryUpdated` came earlier
/// @audit event/error `ServiceRegistryUpdated` came earlier
/// @audit event/error `DonatorBlacklistUpdated` came earlier
/// @audit event/error `EpochSettled` came earlier
/// @audit event/error `TokenomicsImplementationUpdated` came earlier
199:     uint32 public timeLaunch;

/// @audit event/error `OwnerUpdated` came earlier
/// @audit event/error `TreasuryUpdated` came earlier
/// @audit event/error `DepositoryUpdated` came earlier
/// @audit event/error `DispenserUpdated` came earlier
/// @audit event/error `EpochLengthUpdated` came earlier
/// @audit event/error `EffectiveBondUpdated` came earlier
/// @audit event/error `IDFUpdated` came earlier
/// @audit event/error `TokenomicsParametersUpdateRequested` came earlier
/// @audit event/error `TokenomicsParametersUpdated` came earlier
/// @audit event/error `IncentiveFractionsUpdateRequested` came earlier
/// @audit event/error `IncentiveFractionsUpdated` came earlier
/// @audit event/error `ComponentRegistryUpdated` came earlier
/// @audit event/error `AgentRegistryUpdated` came earlier
/// @audit event/error `ServiceRegistryUpdated` came earlier
/// @audit event/error `DonatorBlacklistUpdated` came earlier
/// @audit event/error `EpochSettled` came earlier
/// @audit event/error `TokenomicsImplementationUpdated` came earlier
202:     uint32 public nextEpochLen;

/// @audit event/error `OwnerUpdated` came earlier
/// @audit event/error `TreasuryUpdated` came earlier
/// @audit event/error `DepositoryUpdated` came earlier
/// @audit event/error `DispenserUpdated` came earlier
/// @audit event/error `EpochLengthUpdated` came earlier
/// @audit event/error `EffectiveBondUpdated` came earlier
/// @audit event/error `IDFUpdated` came earlier
/// @audit event/error `TokenomicsParametersUpdateRequested` came earlier
/// @audit event/error `TokenomicsParametersUpdated` came earlier
/// @audit event/error `IncentiveFractionsUpdateRequested` came earlier
/// @audit event/error `IncentiveFractionsUpdated` came earlier
/// @audit event/error `ComponentRegistryUpdated` came earlier
/// @audit event/error `AgentRegistryUpdated` came earlier
/// @audit event/error `ServiceRegistryUpdated` came earlier
/// @audit event/error `DonatorBlacklistUpdated` came earlier
/// @audit event/error `EpochSettled` came earlier
/// @audit event/error `TokenomicsImplementationUpdated` came earlier
205:     address public ve;

/// @audit event/error `OwnerUpdated` came earlier
/// @audit event/error `TreasuryUpdated` came earlier
/// @audit event/error `DepositoryUpdated` came earlier
/// @audit event/error `DispenserUpdated` came earlier
/// @audit event/error `EpochLengthUpdated` came earlier
/// @audit event/error `EffectiveBondUpdated` came earlier
/// @audit event/error `IDFUpdated` came earlier
/// @audit event/error `TokenomicsParametersUpdateRequested` came earlier
/// @audit event/error `TokenomicsParametersUpdated` came earlier
/// @audit event/error `IncentiveFractionsUpdateRequested` came earlier
/// @audit event/error `IncentiveFractionsUpdated` came earlier
/// @audit event/error `ComponentRegistryUpdated` came earlier
/// @audit event/error `AgentRegistryUpdated` came earlier
/// @audit event/error `ServiceRegistryUpdated` came earlier
/// @audit event/error `DonatorBlacklistUpdated` came earlier
/// @audit event/error `EpochSettled` came earlier
/// @audit event/error `TokenomicsImplementationUpdated` came earlier
208:     uint72 public devsPerCapital;

/// @audit event/error `OwnerUpdated` came earlier
/// @audit event/error `TreasuryUpdated` came earlier
/// @audit event/error `DepositoryUpdated` came earlier
/// @audit event/error `DispenserUpdated` came earlier
/// @audit event/error `EpochLengthUpdated` came earlier
/// @audit event/error `EffectiveBondUpdated` came earlier
/// @audit event/error `IDFUpdated` came earlier
/// @audit event/error `TokenomicsParametersUpdateRequested` came earlier
/// @audit event/error `TokenomicsParametersUpdated` came earlier
/// @audit event/error `IncentiveFractionsUpdateRequested` came earlier
/// @audit event/error `IncentiveFractionsUpdated` came earlier
/// @audit event/error `ComponentRegistryUpdated` came earlier
/// @audit event/error `AgentRegistryUpdated` came earlier
/// @audit event/error `ServiceRegistryUpdated` came earlier
/// @audit event/error `DonatorBlacklistUpdated` came earlier
/// @audit event/error `EpochSettled` came earlier
/// @audit event/error `TokenomicsImplementationUpdated` came earlier
211:     address public donatorBlacklist;

/// @audit event/error `OwnerUpdated` came earlier
/// @audit event/error `TreasuryUpdated` came earlier
/// @audit event/error `DepositoryUpdated` came earlier
/// @audit event/error `DispenserUpdated` came earlier
/// @audit event/error `EpochLengthUpdated` came earlier
/// @audit event/error `EffectiveBondUpdated` came earlier
/// @audit event/error `IDFUpdated` came earlier
/// @audit event/error `TokenomicsParametersUpdateRequested` came earlier
/// @audit event/error `TokenomicsParametersUpdated` came earlier
/// @audit event/error `IncentiveFractionsUpdateRequested` came earlier
/// @audit event/error `IncentiveFractionsUpdated` came earlier
/// @audit event/error `ComponentRegistryUpdated` came earlier
/// @audit event/error `AgentRegistryUpdated` came earlier
/// @audit event/error `ServiceRegistryUpdated` came earlier
/// @audit event/error `DonatorBlacklistUpdated` came earlier
/// @audit event/error `EpochSettled` came earlier
/// @audit event/error `TokenomicsImplementationUpdated` came earlier
214:     uint32 public lastDonationBlockNumber;

/// @audit event/error `OwnerUpdated` came earlier
/// @audit event/error `TreasuryUpdated` came earlier
/// @audit event/error `DepositoryUpdated` came earlier
/// @audit event/error `DispenserUpdated` came earlier
/// @audit event/error `EpochLengthUpdated` came earlier
/// @audit event/error `EffectiveBondUpdated` came earlier
/// @audit event/error `IDFUpdated` came earlier
/// @audit event/error `TokenomicsParametersUpdateRequested` came earlier
/// @audit event/error `TokenomicsParametersUpdated` came earlier
/// @audit event/error `IncentiveFractionsUpdateRequested` came earlier
/// @audit event/error `IncentiveFractionsUpdated` came earlier
/// @audit event/error `ComponentRegistryUpdated` came earlier
/// @audit event/error `AgentRegistryUpdated` came earlier
/// @audit event/error `ServiceRegistryUpdated` came earlier
/// @audit event/error `DonatorBlacklistUpdated` came earlier
/// @audit event/error `EpochSettled` came earlier
/// @audit event/error `TokenomicsImplementationUpdated` came earlier
217:     mapping(uint256 => uint256) public mapServiceAmounts;

/// @audit event/error `OwnerUpdated` came earlier
/// @audit event/error `TreasuryUpdated` came earlier
/// @audit event/error `DepositoryUpdated` came earlier
/// @audit event/error `DispenserUpdated` came earlier
/// @audit event/error `EpochLengthUpdated` came earlier
/// @audit event/error `EffectiveBondUpdated` came earlier
/// @audit event/error `IDFUpdated` came earlier
/// @audit event/error `TokenomicsParametersUpdateRequested` came earlier
/// @audit event/error `TokenomicsParametersUpdated` came earlier
/// @audit event/error `IncentiveFractionsUpdateRequested` came earlier
/// @audit event/error `IncentiveFractionsUpdated` came earlier
/// @audit event/error `ComponentRegistryUpdated` came earlier
/// @audit event/error `AgentRegistryUpdated` came earlier
/// @audit event/error `ServiceRegistryUpdated` came earlier
/// @audit event/error `DonatorBlacklistUpdated` came earlier
/// @audit event/error `EpochSettled` came earlier
/// @audit event/error `TokenomicsImplementationUpdated` came earlier
219:     mapping(address => uint256) public mapOwnerRewards;

/// @audit event/error `OwnerUpdated` came earlier
/// @audit event/error `TreasuryUpdated` came earlier
/// @audit event/error `DepositoryUpdated` came earlier
/// @audit event/error `DispenserUpdated` came earlier
/// @audit event/error `EpochLengthUpdated` came earlier
/// @audit event/error `EffectiveBondUpdated` came earlier
/// @audit event/error `IDFUpdated` came earlier
/// @audit event/error `TokenomicsParametersUpdateRequested` came earlier
/// @audit event/error `TokenomicsParametersUpdated` came earlier
/// @audit event/error `IncentiveFractionsUpdateRequested` came earlier
/// @audit event/error `IncentiveFractionsUpdated` came earlier
/// @audit event/error `ComponentRegistryUpdated` came earlier
/// @audit event/error `AgentRegistryUpdated` came earlier
/// @audit event/error `ServiceRegistryUpdated` came earlier
/// @audit event/error `DonatorBlacklistUpdated` came earlier
/// @audit event/error `EpochSettled` came earlier
/// @audit event/error `TokenomicsImplementationUpdated` came earlier
221:     mapping(address => uint256) public mapOwnerTopUps;

/// @audit event/error `OwnerUpdated` came earlier
/// @audit event/error `TreasuryUpdated` came earlier
/// @audit event/error `DepositoryUpdated` came earlier
/// @audit event/error `DispenserUpdated` came earlier
/// @audit event/error `EpochLengthUpdated` came earlier
/// @audit event/error `EffectiveBondUpdated` came earlier
/// @audit event/error `IDFUpdated` came earlier
/// @audit event/error `TokenomicsParametersUpdateRequested` came earlier
/// @audit event/error `TokenomicsParametersUpdated` came earlier
/// @audit event/error `IncentiveFractionsUpdateRequested` came earlier
/// @audit event/error `IncentiveFractionsUpdated` came earlier
/// @audit event/error `ComponentRegistryUpdated` came earlier
/// @audit event/error `AgentRegistryUpdated` came earlier
/// @audit event/error `ServiceRegistryUpdated` came earlier
/// @audit event/error `DonatorBlacklistUpdated` came earlier
/// @audit event/error `EpochSettled` came earlier
/// @audit event/error `TokenomicsImplementationUpdated` came earlier
223:     mapping(uint256 => TokenomicsPoint) public mapEpochTokenomics;

/// @audit event/error `OwnerUpdated` came earlier
/// @audit event/error `TreasuryUpdated` came earlier
/// @audit event/error `DepositoryUpdated` came earlier
/// @audit event/error `DispenserUpdated` came earlier
/// @audit event/error `EpochLengthUpdated` came earlier
/// @audit event/error `EffectiveBondUpdated` came earlier
/// @audit event/error `IDFUpdated` came earlier
/// @audit event/error `TokenomicsParametersUpdateRequested` came earlier
/// @audit event/error `TokenomicsParametersUpdated` came earlier
/// @audit event/error `IncentiveFractionsUpdateRequested` came earlier
/// @audit event/error `IncentiveFractionsUpdated` came earlier
/// @audit event/error `ComponentRegistryUpdated` came earlier
/// @audit event/error `AgentRegistryUpdated` came earlier
/// @audit event/error `ServiceRegistryUpdated` came earlier
/// @audit event/error `DonatorBlacklistUpdated` came earlier
/// @audit event/error `EpochSettled` came earlier
/// @audit event/error `TokenomicsImplementationUpdated` came earlier
225:     mapping(uint256 => mapping(uint256 => bool)) public mapNewUnits;

/// @audit event/error `OwnerUpdated` came earlier
/// @audit event/error `TreasuryUpdated` came earlier
/// @audit event/error `DepositoryUpdated` came earlier
/// @audit event/error `DispenserUpdated` came earlier
/// @audit event/error `EpochLengthUpdated` came earlier
/// @audit event/error `EffectiveBondUpdated` came earlier
/// @audit event/error `IDFUpdated` came earlier
/// @audit event/error `TokenomicsParametersUpdateRequested` came earlier
/// @audit event/error `TokenomicsParametersUpdated` came earlier
/// @audit event/error `IncentiveFractionsUpdateRequested` came earlier
/// @audit event/error `IncentiveFractionsUpdated` came earlier
/// @audit event/error `ComponentRegistryUpdated` came earlier
/// @audit event/error `AgentRegistryUpdated` came earlier
/// @audit event/error `ServiceRegistryUpdated` came earlier
/// @audit event/error `DonatorBlacklistUpdated` came earlier
/// @audit event/error `EpochSettled` came earlier
/// @audit event/error `TokenomicsImplementationUpdated` came earlier
227:     mapping(address => bool) public mapNewOwners;

/// @audit event/error `OwnerUpdated` came earlier
/// @audit event/error `TreasuryUpdated` came earlier
/// @audit event/error `DepositoryUpdated` came earlier
/// @audit event/error `DispenserUpdated` came earlier
/// @audit event/error `EpochLengthUpdated` came earlier
/// @audit event/error `EffectiveBondUpdated` came earlier
/// @audit event/error `IDFUpdated` came earlier
/// @audit event/error `TokenomicsParametersUpdateRequested` came earlier
/// @audit event/error `TokenomicsParametersUpdated` came earlier
/// @audit event/error `IncentiveFractionsUpdateRequested` came earlier
/// @audit event/error `IncentiveFractionsUpdated` came earlier
/// @audit event/error `ComponentRegistryUpdated` came earlier
/// @audit event/error `AgentRegistryUpdated` came earlier
/// @audit event/error `ServiceRegistryUpdated` came earlier
/// @audit event/error `DonatorBlacklistUpdated` came earlier
/// @audit event/error `EpochSettled` came earlier
/// @audit event/error `TokenomicsImplementationUpdated` came earlier
229:     mapping(uint256 => mapping(uint256 => IncentiveBalances)) public mapUnitIncentives;

Github: [140, 143, 146, 148, 151, 154, 157, 161, 164, 167, 170, 172, 174, 177, 181, 184, 187, 190, 193, 196, 199, 202, 205, 208, 211, 214, 217, 219, 221, 223, 225, 227, 229]

File: tokenomics/contracts/TokenomicsProxy.sol

/// @audit event/error `InitializationFailed` came earlier
/// @audit event/error `ZeroTokenomicsAddress` came earlier
/// @audit event/error `ZeroTokenomicsData` came earlier
28:     bytes32 public constant PROXY_TOKENOMICS = 0xbd5523e7c3b6a94aa0e3b24d1120addc2f95c7029e097b466b2bedc8d4b4362f;

Github: [28]

File: tokenomics/contracts/Treasury.sol

/// @audit event/error `OwnerUpdated` came earlier
/// @audit event/error `TokenomicsUpdated` came earlier
/// @audit event/error `DepositoryUpdated` came earlier
/// @audit event/error `DispenserUpdated` came earlier
/// @audit event/error `DepositTokenFromAccount` came earlier
/// @audit event/error `DonateToServicesETH` came earlier
/// @audit event/error `Withdraw` came earlier
/// @audit event/error `EnableToken` came earlier
/// @audit event/error `DisableToken` came earlier
/// @audit event/error `ReceiveETH` came earlier
/// @audit event/error `UpdateTreasuryBalances` came earlier
/// @audit event/error `PauseTreasury` came earlier
/// @audit event/error `UnpauseTreasury` came earlier
/// @audit event/error `MinAcceptedETHUpdated` came earlier
56:     address public constant ETH_TOKEN_ADDRESS = address(0xEeeeeEeeeEeEeeEeEeEeeEEEeeeeEeeeeeeeEEeE);

/// @audit event/error `OwnerUpdated` came earlier
/// @audit event/error `TokenomicsUpdated` came earlier
/// @audit event/error `DepositoryUpdated` came earlier
/// @audit event/error `DispenserUpdated` came earlier
/// @audit event/error `DepositTokenFromAccount` came earlier
/// @audit event/error `DonateToServicesETH` came earlier
/// @audit event/error `Withdraw` came earlier
/// @audit event/error `EnableToken` came earlier
/// @audit event/error `DisableToken` came earlier
/// @audit event/error `ReceiveETH` came earlier
/// @audit event/error `UpdateTreasuryBalances` came earlier
/// @audit event/error `PauseTreasury` came earlier
/// @audit event/error `UnpauseTreasury` came earlier
/// @audit event/error `MinAcceptedETHUpdated` came earlier
59:     address public owner;

/// @audit event/error `OwnerUpdated` came earlier
/// @audit event/error `TokenomicsUpdated` came earlier
/// @audit event/error `DepositoryUpdated` came earlier
/// @audit event/error `DispenserUpdated` came earlier
/// @audit event/error `DepositTokenFromAccount` came earlier
/// @audit event/error `DonateToServicesETH` came earlier
/// @audit event/error `Withdraw` came earlier
/// @audit event/error `EnableToken` came earlier
/// @audit event/error `DisableToken` came earlier
/// @audit event/error `ReceiveETH` came earlier
/// @audit event/error `UpdateTreasuryBalances` came earlier
/// @audit event/error `PauseTreasury` came earlier
/// @audit event/error `UnpauseTreasury` came earlier
/// @audit event/error `MinAcceptedETHUpdated` came earlier
62:     uint96 public ETHFromServices;

/// @audit event/error `OwnerUpdated` came earlier
/// @audit event/error `TokenomicsUpdated` came earlier
/// @audit event/error `DepositoryUpdated` came earlier
/// @audit event/error `DispenserUpdated` came earlier
/// @audit event/error `DepositTokenFromAccount` came earlier
/// @audit event/error `DonateToServicesETH` came earlier
/// @audit event/error `Withdraw` came earlier
/// @audit event/error `EnableToken` came earlier
/// @audit event/error `DisableToken` came earlier
/// @audit event/error `ReceiveETH` came earlier
/// @audit event/error `UpdateTreasuryBalances` came earlier
/// @audit event/error `PauseTreasury` came earlier
/// @audit event/error `UnpauseTreasury` came earlier
/// @audit event/error `MinAcceptedETHUpdated` came earlier
65:     address public olas;

/// @audit event/error `OwnerUpdated` came earlier
/// @audit event/error `TokenomicsUpdated` came earlier
/// @audit event/error `DepositoryUpdated` came earlier
/// @audit event/error `DispenserUpdated` came earlier
/// @audit event/error `DepositTokenFromAccount` came earlier
/// @audit event/error `DonateToServicesETH` came earlier
/// @audit event/error `Withdraw` came earlier
/// @audit event/error `EnableToken` came earlier
/// @audit event/error `DisableToken` came earlier
/// @audit event/error `ReceiveETH` came earlier
/// @audit event/error `UpdateTreasuryBalances` came earlier
/// @audit event/error `PauseTreasury` came earlier
/// @audit event/error `UnpauseTreasury` came earlier
/// @audit event/error `MinAcceptedETHUpdated` came earlier
68:     uint96 public ETHOwned;

/// @audit event/error `OwnerUpdated` came earlier
/// @audit event/error `TokenomicsUpdated` came earlier
/// @audit event/error `DepositoryUpdated` came earlier
/// @audit event/error `DispenserUpdated` came earlier
/// @audit event/error `DepositTokenFromAccount` came earlier
/// @audit event/error `DonateToServicesETH` came earlier
/// @audit event/error `Withdraw` came earlier
/// @audit event/error `EnableToken` came earlier
/// @audit event/error `DisableToken` came earlier
/// @audit event/error `ReceiveETH` came earlier
/// @audit event/error `UpdateTreasuryBalances` came earlier
/// @audit event/error `PauseTreasury` came earlier
/// @audit event/error `UnpauseTreasury` came earlier
/// @audit event/error `MinAcceptedETHUpdated` came earlier
71:     address public tokenomics;

/// @audit event/error `OwnerUpdated` came earlier
/// @audit event/error `TokenomicsUpdated` came earlier
/// @audit event/error `DepositoryUpdated` came earlier
/// @audit event/error `DispenserUpdated` came earlier
/// @audit event/error `DepositTokenFromAccount` came earlier
/// @audit event/error `DonateToServicesETH` came earlier
/// @audit event/error `Withdraw` came earlier
/// @audit event/error `EnableToken` came earlier
/// @audit event/error `DisableToken` came earlier
/// @audit event/error `ReceiveETH` came earlier
/// @audit event/error `UpdateTreasuryBalances` came earlier
/// @audit event/error `PauseTreasury` came earlier
/// @audit event/error `UnpauseTreasury` came earlier
/// @audit event/error `MinAcceptedETHUpdated` came earlier
73:     uint96 public minAcceptedETH = 0.065 ether;

/// @audit event/error `OwnerUpdated` came earlier
/// @audit event/error `TokenomicsUpdated` came earlier
/// @audit event/error `DepositoryUpdated` came earlier
/// @audit event/error `DispenserUpdated` came earlier
/// @audit event/error `DepositTokenFromAccount` came earlier
/// @audit event/error `DonateToServicesETH` came earlier
/// @audit event/error `Withdraw` came earlier
/// @audit event/error `EnableToken` came earlier
/// @audit event/error `DisableToken` came earlier
/// @audit event/error `ReceiveETH` came earlier
/// @audit event/error `UpdateTreasuryBalances` came earlier
/// @audit event/error `PauseTreasury` came earlier
/// @audit event/error `UnpauseTreasury` came earlier
/// @audit event/error `MinAcceptedETHUpdated` came earlier
76:     address public depository;

/// @audit event/error `OwnerUpdated` came earlier
/// @audit event/error `TokenomicsUpdated` came earlier
/// @audit event/error `DepositoryUpdated` came earlier
/// @audit event/error `DispenserUpdated` came earlier
/// @audit event/error `DepositTokenFromAccount` came earlier
/// @audit event/error `DonateToServicesETH` came earlier
/// @audit event/error `Withdraw` came earlier
/// @audit event/error `EnableToken` came earlier
/// @audit event/error `DisableToken` came earlier
/// @audit event/error `ReceiveETH` came earlier
/// @audit event/error `UpdateTreasuryBalances` came earlier
/// @audit event/error `PauseTreasury` came earlier
/// @audit event/error `UnpauseTreasury` came earlier
/// @audit event/error `MinAcceptedETHUpdated` came earlier
78:     uint8 public paused = 1;

/// @audit event/error `OwnerUpdated` came earlier
/// @audit event/error `TokenomicsUpdated` came earlier
/// @audit event/error `DepositoryUpdated` came earlier
/// @audit event/error `DispenserUpdated` came earlier
/// @audit event/error `DepositTokenFromAccount` came earlier
/// @audit event/error `DonateToServicesETH` came earlier
/// @audit event/error `Withdraw` came earlier
/// @audit event/error `EnableToken` came earlier
/// @audit event/error `DisableToken` came earlier
/// @audit event/error `ReceiveETH` came earlier
/// @audit event/error `UpdateTreasuryBalances` came earlier
/// @audit event/error `PauseTreasury` came earlier
/// @audit event/error `UnpauseTreasury` came earlier
/// @audit event/error `MinAcceptedETHUpdated` came earlier
80:     uint8 internal _locked;

/// @audit event/error `OwnerUpdated` came earlier
/// @audit event/error `TokenomicsUpdated` came earlier
/// @audit event/error `DepositoryUpdated` came earlier
/// @audit event/error `DispenserUpdated` came earlier
/// @audit event/error `DepositTokenFromAccount` came earlier
/// @audit event/error `DonateToServicesETH` came earlier
/// @audit event/error `Withdraw` came earlier
/// @audit event/error `EnableToken` came earlier
/// @audit event/error `DisableToken` came earlier
/// @audit event/error `ReceiveETH` came earlier
/// @audit event/error `UpdateTreasuryBalances` came earlier
/// @audit event/error `PauseTreasury` came earlier
/// @audit event/error `UnpauseTreasury` came earlier
/// @audit event/error `MinAcceptedETHUpdated` came earlier
83:     address public dispenser;

/// @audit event/error `OwnerUpdated` came earlier
/// @audit event/error `TokenomicsUpdated` came earlier
/// @audit event/error `DepositoryUpdated` came earlier
/// @audit event/error `DispenserUpdated` came earlier
/// @audit event/error `DepositTokenFromAccount` came earlier
/// @audit event/error `DonateToServicesETH` came earlier
/// @audit event/error `Withdraw` came earlier
/// @audit event/error `EnableToken` came earlier
/// @audit event/error `DisableToken` came earlier
/// @audit event/error `ReceiveETH` came earlier
/// @audit event/error `UpdateTreasuryBalances` came earlier
/// @audit event/error `PauseTreasury` came earlier
/// @audit event/error `UnpauseTreasury` came earlier
/// @audit event/error `MinAcceptedETHUpdated` came earlier
86:     mapping(address => uint256) public mapTokenReserves;

/// @audit event/error `OwnerUpdated` came earlier
/// @audit event/error `TokenomicsUpdated` came earlier
/// @audit event/error `DepositoryUpdated` came earlier
/// @audit event/error `DispenserUpdated` came earlier
/// @audit event/error `DepositTokenFromAccount` came earlier
/// @audit event/error `DonateToServicesETH` came earlier
/// @audit event/error `Withdraw` came earlier
/// @audit event/error `EnableToken` came earlier
/// @audit event/error `DisableToken` came earlier
/// @audit event/error `ReceiveETH` came earlier
/// @audit event/error `UpdateTreasuryBalances` came earlier
/// @audit event/error `PauseTreasury` came earlier
/// @audit event/error `UnpauseTreasury` came earlier
/// @audit event/error `MinAcceptedETHUpdated` came earlier
88:     mapping(address => bool) public mapEnabledTokens;

Github: [56, 59, 62, 65, 68, 71, 73, 76, 78, 80, 83, 86, 88]

[NC-18] Contract name does not follow the Solidity Style Guide

According to the Solidity Style Guide, contracts and libraries should be named using the CapWords style and match their filenames.

There are 2 instances of this issue:

File: governance/contracts/veOLAS.sol

86: contract veOLAS is IErrors, IVotes, IERC20, IERC165 {

Github: [86]

File: governance/contracts/wveOLAS.sol

130: contract wveOLAS {

Github: [130]

[NC-19] Contract should expose an `interface`

All external/public functions should extend an interface. This is useful to make sure that the whole API is extracted.

Note: It is possible that the interface is out-of-scope and has not been seen by the bot.

There are 85 instances (click to show):

File: governance/contracts/GovernorOLAS.sol

45:     function propose(

57:     function proposalThreshold() public view override(Governor, GovernorSettings) returns (uint256)

Github: [45, 57]

File: governance/contracts/OLAS.sol

43:     function changeOwner(address newOwner) external {

58:     function changeMinter(address newMinter) external {

91:     function inflationControl(uint256 amount) public view returns (bool) {

98:     function inflationRemainder() public view returns (uint256 remainder) {

128:     function decreaseAllowance(address spender, uint256 amount) external returns (bool) {

145:     function increaseAllowance(address spender, uint256 amount) external returns (bool) {

Github: [43, 58, 91, 98, 128, 145]

File: governance/contracts/bridges/BridgedERC20.sol

30:     function changeOwner(address newOwner) external {

Github: [30]

File: governance/contracts/bridges/FxERC20ChildTunnel.sol

50:     function deposit(uint256 amount) external {

57:     function depositTo(address to, uint256 amount) external {

Github: [50, 57]

File: governance/contracts/bridges/FxERC20RootTunnel.sol

54:     function withdraw(uint256 amount) external {

61:     function withdrawTo(address to, uint256 amount) external {

Github: [54, 61]

File: governance/contracts/bridges/FxGovernorTunnel.sol

81:     function changeRootGovernor(address newRootGovernor) external {

Github: [81]

File: governance/contracts/bridges/HomeMediator.sol

81:     function changeForeignGovernor(address newForeignGovernor) external {

105:     function processMessageFromForeign(bytes memory data) external {

Github: [81, 105]

File: governance/contracts/multisigs/GuardCM.sol

154:     function changeGovernor(address newGovernor) external {

170:     function changeGovernorCheckProposalId(uint256 proposalId) external {

387:     function checkTransaction(

441:     function setTargetSelectorChainIds(

495:     function setBridgeMediatorChainIds(

539:     function pause() external {

560:     function unpause() external {

572:     function checkAfterExecution(bytes32, bool) external {}

579:     function getTargetSelectorChainId(address target, bytes4 selector, uint256 chainId) external view

597:     function getBridgeMediatorChainId(address bridgeMediatorL1) external view

Github: [154, 170, 387, 441, 495, 539, 560, 572, 579, 597]

File: governance/contracts/veOLAS.sol

376:     function depositFor(address account, uint256 amount) external {

402:     function createLock(uint256 amount, uint256 unlockTime) external {

411:     function createLockFor(address account, uint256 amount, uint256 unlockTime) external {

458:     function increaseAmount(uint256 amount) external {

483:     function increaseUnlockTime(uint256 unlockTime) external {

510:     function withdraw() external {

794:     function delegate(address delegatee) external virtual override

800:     function delegateBySig(address delegatee, uint256 nonce, uint256 expiry, uint8 v, bytes32 r, bytes32 s)

Github: [376, 402, 411, 458, 483, 510, 794, 800]

File: governance/contracts/wveOLAS.sol

322:     function delegate(address) external

328:     function delegateBySig(address, uint256, uint256, uint8, bytes32, bytes32) external

Github: [322, 328]

File: registries/contracts/GenericManager.sol

20:     function changeOwner(address newOwner) external virtual {

36:     function pause() external virtual {

47:     function unpause() external virtual {

Github: [20, 36, 47]

File: registries/contracts/GenericRegistry.sol

37:     function changeOwner(address newOwner) external virtual {

54:     function changeManager(address newManager) external virtual {

78:     function setBaseURI(string memory bURI) external virtual {

97:     function tokenByIndex(uint256 id) external view virtual returns (uint256 unitId) {

135:     function tokenURI(uint256 unitId) public view virtual override returns (string memory) {

Github: [37, 54, 78, 97, 135]

File: registries/contracts/UnitRegistry.sol

152:     function getUnit(uint256 unitId) external view virtual returns (Unit memory unit) {

160:     function getDependencies(uint256 unitId) external view virtual

Github: [152, 160]

File: tokenomics/contracts/Depository.sol

123:     function changeOwner(address newOwner) external {

143:     function changeManagers(address _tokenomics, address _treasury) external {

163:     function changeBondCalculator(address _bondCalculator) external {

244:     function close(uint256[] memory productIds) external returns (uint256[] memory closedProductIds) {

291:     function deposit(uint256 productId, uint256 tokenAmount) external

356:     function redeem(uint256[] memory bondIds) external returns (uint256 payout) {

396:     function getProducts(bool active) external view returns (uint256[] memory productIds) {

424:     function isActiveProduct(uint256 productId) external view returns (bool status) {

435:     function getBonds(address account, bool matured) external view

480:     function getBondStatus(uint256 bondId) external view returns (uint256 payout, bool matured) {

Github: [123, 143, 163, 244, 291, 356, 396, 424, 435, 480]

File: tokenomics/contracts/Dispenser.sol

46:     function changeOwner(address newOwner) external {

64:     function changeManagers(address _tokenomics, address _treasury) external {

89:     function claimOwnerIncentives(uint256[] memory unitTypes, uint256[] memory unitIds) external

Github: [46, 64, 89]

File: tokenomics/contracts/DonatorBlacklist.sol

36:     function changeOwner(address newOwner) external {

56:     function setDonatorsStatuses(address[] memory accounts, bool[] memory statuses) external returns (bool success) {

Github: [36, 56]

File: tokenomics/contracts/Tokenomics.sol

264:     function initializeTokenomics(

374:     function tokenomicsImplementation() external view returns (address implementation) {

384:     function changeTokenomicsImplementation(address implementation) external {

404:     function changeOwner(address newOwner) external {

423:     function changeManagers(address _treasury, address _depository, address _dispenser) external {

450:     function changeRegistries(address _componentRegistry, address _agentRegistry, address _serviceRegistry) external {

474:     function changeDonatorBlacklist(address _donatorBlacklist) external {

497:     function changeTokenomicsParameters(

562:     function changeIncentiveFractions(

1160:     function getOwnerIncentives(address account, uint256[] memory unitTypes, uint256[] memory unitIds) external view

1237:     function getInflationPerEpoch() external view returns (uint256 inflationPerEpoch) {

1245:     function getUnitPoint(uint256 epoch, uint256 unitType) external view returns (UnitPoint memory up) {

1252:     function getIDF(uint256 epoch) external view returns (uint256 idf)

Github: [264, 374, 384, 404, 423, 450, 474, 497, 562, 1160, 1237, 1245, 1252]

File: tokenomics/contracts/TokenomicsConstants.sol

30:     function getSupplyCapForYear(uint256 numYears) public pure returns (uint256 supplyCap) {

66:     function getInflationForYear(uint256 numYears) public pure returns (uint256 inflationAmount) {

Github: [30, 66]

File: tokenomics/contracts/Treasury.sol

137:     function changeOwner(address newOwner) external {

156:     function changeManagers(address _tokenomics, address _depository, address _dispenser) external {

182:     function changeMinAcceptedETH(uint256 _minAcceptedETH) external {

313:     function withdraw(address to, uint256 tokenAmount, address token) external returns (bool success) {

466:     function drainServiceSlashedFunds() external returns (uint256 amount) {

487:     function enableToken(address token) external {

507:     function disableToken(address token) external {

531:     function pause() external {

542:     function unpause() external {

Github: [137, 156, 182, 313, 466, 487, 507, 531, 542]

[NC-20] Contract timekeeping will break earlier than the Ethereum network itself will stop working

When a timestamp is downcast from uint256 to uint32, the value will wrap in the year 2106, and the contracts will break. Other downcasts will have different endpoints. Consider whether your contract is intended to live past the size of the type being used.

There are 2 instances of this issue:

File: tokenomics/contracts/Tokenomics.sol

334:         mapEpochTokenomics[0].epochPoint.endTime = uint32(block.timestamp);

1005:         tp.epochPoint.endTime = uint32(block.timestamp);

Github: [334, 1005]

[NC-21] Contracts should each be defined in separate files

Keeping each contract in a separate file makes it easier to work with multiple people, makes the code easier to maintain, and is a common practice on most projects. The following files each contains more than one contract/library/interface.

There are 12 instances (click to show):

File: governance/contracts/bridges/FxGovernorTunnel.sol

/// @audit another contract/library/interface is defined in this file
5: interface IFxMessageProcessor {

/// @audit another contract/library/interface is defined in this file
46: contract FxGovernorTunnel is IFxMessageProcessor {

Github: [5, 46]

File: governance/contracts/bridges/HomeMediator.sol

/// @audit another contract/library/interface is defined in this file
5: interface IAMB {

/// @audit another contract/library/interface is defined in this file
46: contract HomeMediator {

Github: [5, 46]

File: governance/contracts/multisigs/GuardCM.sol

/// @audit another contract/library/interface is defined in this file
6: interface IGovernor {

/// @audit another contract/library/interface is defined in this file
88: contract GuardCM {

Github: [6, 88]

File: governance/contracts/wveOLAS.sol

/// @audit another contract/library/interface is defined in this file
13: interface IVEOLAS {

/// @audit another contract/library/interface is defined in this file
130: contract wveOLAS {

Github: [13, 130]

File: registries/contracts/multisigs/GnosisSafeMultisig.sol

/// @audit another contract/library/interface is defined in this file
5: interface IGnosisSafeProxyFactory {

/// @audit another contract/library/interface is defined in this file
24: contract GnosisSafeMultisig {

Github: [5, 24]

File: registries/contracts/multisigs/GnosisSafeSameAddressMultisig.sol

/// @audit another contract/library/interface is defined in this file
5: interface IGnosisSafe {

/// @audit another contract/library/interface is defined in this file
50: contract GnosisSafeSameAddressMultisig {

Github: [5, 50]

[NC-22] Contracts should have full test coverage

While 100% code coverage does not guarantee that there are no bugs, it often will catch easy-to-find bugs, and will ensure that there are fewer regressions when the code invariably has to be modified. Furthermore, in order to get full coverage, code authors will often have to re-organize their code so that it is more modular, so that each component can be tested separately, which reduces interdependencies between modules and layers, and makes for code that is easier to reason about and audit.

There is one instance of this issue:

Global finding

Github: [Global]

[NC-23] Convert simple `if` statements to ternary expressions

Converting some if statements to ternaries (such as z = (a < b) ? x : y) can make the code more concise and easier to read.

There are 6 instances of this issue:

File: governance/contracts/veOLAS.sol

202:                 if (newLocked.endTime == oldLocked.endTime) {
                         newDSlope = oldDSlope;
                     } else {
                         newDSlope = mapSlopeChanges[newLocked.endTime];

211:         if (curNumPoint > 0) {
                 lastPoint = mapSupplyPoints[curNumPoint];
             } else {
                 // If no point is created yet, we take the actual time and block parameters
                 lastPoint = PointVoting(0, 0, uint64(block.timestamp), uint64(block.number), 0);

568:             if (account == address(0)) {
                     point = mapSupplyPoints[mid];
                 } else {
                     point = mapUserPoints[account][mid];

582:         if (account == address(0)) {
                 point = mapSupplyPoints[minPointNumber];
             } else {
                 point = mapUserPoints[account][minPointNumber];

Github: [202, 211, 568, 582]

File: registries/contracts/RegistriesManager.sol

38:         if (unitType == IRegistry.UnitType.Component) {
                unitId = IRegistry(componentRegistry).create(unitOwner, unitHash, dependencies);
            } else {
                unitId = IRegistry(agentRegistry).create(unitOwner, unitHash, dependencies);

51:         if (unitType == IRegistry.UnitType.Component) {
                success = IRegistry(componentRegistry).updateHash(msg.sender, unitId, unitHash);
            } else {
                success = IRegistry(agentRegistry).updateHash(msg.sender, unitId, unitHash);

Github: [38, 51]

[NC-24] Events that mark critical parameter changes should contain both the old and the new value

This should especially be done if the new value is not required to be different from the old value.

There are 80 instances (click to show):

File: governance/contracts/OLAS.sol

53:         emit OwnerUpdated(newOwner);

68:         emit MinterUpdated(newMinter);

134:             emit Approval(msg.sender, spender, spenderAllowance);

150:         emit Approval(msg.sender, spender, spenderAllowance);

Github: [53, 68, 134, 150]

File: governance/contracts/bridges/BridgedERC20.sol

42:         emit OwnerUpdated(newOwner);

Github: [42]

File: governance/contracts/bridges/FxERC20ChildTunnel.sol

84:         emit FxWithdrawERC20(rootToken, childToken, from, to, amount);

107:         emit FxDepositERC20(childToken, rootToken, msg.sender, to, amount);

Github: [84, 107]

File: governance/contracts/bridges/FxERC20RootTunnel.sol

79:         emit FxDepositERC20(childToken, rootToken, from, to, amount);

106:         emit FxWithdrawERC20(rootToken, childToken, msg.sender, to, amount);

Github: [79, 106]

File: governance/contracts/bridges/FxGovernorTunnel.sol

74:         emit FundsReceived(msg.sender, msg.value);

94:         emit RootGovernorUpdated(newRootGovernor);

167:         emit MessageReceived(stateId, rootMessageSender, data);

Github: [74, 94, 167]

File: governance/contracts/bridges/HomeMediator.sol

74:         emit FundsReceived(msg.sender, msg.value);

94:         emit ForeignGovernorUpdated(newForeignGovernor);

167:         emit MessageReceived(governor, data);

Github: [74, 94, 167]

File: governance/contracts/multisigs/GuardCM.sol

165:         emit GovernorUpdated(newGovernor);

181:         emit GovernorCheckProposalIdChanged(proposalId);

486:         emit SetTargetSelectors(targets, selectors, chainIds, statuses);

531:         emit SetBridgeMediators(bridgeMediatorL1s, bridgeMediatorL2s, chainIds);

556:         emit GuardPaused(msg.sender);

568:         emit GuardUnpaused();

Github: [165, 181, 486, 531, 556, 568]

File: governance/contracts/veOLAS.sol

367:         emit Deposit(account, amount, lockedBalance.endTime, depositType, block.timestamp);

368:         emit Supply(supplyBefore, supplyAfter);

530:         emit Withdraw(msg.sender, amount, block.timestamp);

531:         emit Supply(supplyBefore, supplyAfter);

Github: [367, 368, 530, 531]

File: registries/contracts/GenericManager.sol

32:         emit OwnerUpdated(newOwner);

43:         emit Pause(msg.sender);

54:         emit Unpause(msg.sender);

Github: [32, 43, 54]

File: registries/contracts/GenericRegistry.sol

49:         emit OwnerUpdated(newOwner);

65:         emit ManagerUpdated(newManager);

90:         emit BaseURIChanged(bURI);

Github: [49, 65, 90]

File: registries/contracts/UnitRegistry.sol

112:         emit CreateUnit(unitId, unitType, unitHash);

146:         emit UpdateUnitHash(unitId, unitType, unitHash);

Github: [112, 146]

File: tokenomics/contracts/Depository.sol

135:         emit OwnerUpdated(newOwner);

152:             emit TokenomicsUpdated(_tokenomics);

157:             emit TreasuryUpdated(_treasury);

171:             emit BondCalculatorUpdated(_bondCalculator);

235:         emit CreateProduct(token, productId, supply, priceLP, vesting);

268:                 emit CloseProduct(token, productId, supply);

342:             emit CloseProduct(token, productId, supply);

345:         emit CreateBond(token, productId, msg.sender, bondId, payout, tokenAmount, maturity);

380:             emit RedeemBond(productId, msg.sender, bondIds[i]);

Github: [135, 152, 157, 171, 235, 268, 342, 345, 380]

File: tokenomics/contracts/Dispenser.sol

58:         emit OwnerUpdated(newOwner);

73:             emit TokenomicsUpdated(_tokenomics);

78:             emit TreasuryUpdated(_treasury);

112:         emit IncentivesClaimed(msg.sender, reward, topUp);

Github: [58, 73, 78, 112]

File: tokenomics/contracts/DonatorBlacklist.sol

48:         emit OwnerUpdated(newOwner);

74:             emit DonatorBlacklistStatus(accounts[i], statuses[i]);

Github: [48, 74]

File: tokenomics/contracts/Tokenomics.sol

399:         emit TokenomicsImplementationUpdated(implementation);

416:         emit OwnerUpdated(newOwner);

432:             emit TreasuryUpdated(_treasury);

437:             emit DepositoryUpdated(_depository);

442:             emit DispenserUpdated(_dispenser);

459:             emit ComponentRegistryUpdated(_componentRegistry);

463:             emit AgentRegistryUpdated(_agentRegistry);

467:             emit ServiceRegistryUpdated(_serviceRegistry);

481:         emit DonatorBlacklistUpdated(_donatorBlacklist);

623:             emit EffectiveBondUpdated(eBond);

643:         emit EffectiveBondUpdated(eBond);

975:             emit IncentiveFractionsUpdated(eCounter + 1);

1002:             emit TokenomicsParametersUpdated(eCounter + 1);

1045:             emit IDFUpdated(idf);

1065:             emit EpochSettled(eCounter, incentives[1], accountRewards, accountTopUps);

Github: [399, 416, 432, 437, 442, 459, 463, 467, 481, 623, 643, 975, 1002, 1045, 1065]

File: tokenomics/contracts/Treasury.sol

132:         emit ReceiveETH(msg.sender, msg.value);

149:         emit OwnerUpdated(newOwner);

165:             emit TokenomicsUpdated(_tokenomics);

170:             emit DepositoryUpdated(_depository);

175:             emit DispenserUpdated(_dispenser);

199:         emit MinAcceptedETHUpdated(_minAcceptedETH);

244:         emit DepositTokenFromAccount(account, token, tokenAmount, olasMintAmount);

295:         emit DonateToServicesETH(msg.sender, serviceIds, amounts, msg.value);

337:                 emit Withdraw(ETH_TOKEN_ADDRESS, to, tokenAmount);

358:                 emit Withdraw(token, to, tokenAmount);

405:             emit Withdraw(ETH_TOKEN_ADDRESS, account, accountRewards);

418:             emit Withdraw(olas, account, accountTopUps);

452:                 emit UpdateTreasuryBalances(amountETHOwned, amountETHFromServices);

501:             emit EnableToken(token);

519:             emit DisableToken(token);

538:         emit PauseTreasury();

549:         emit UnpauseTreasury();

Github: [132, 149, 165, 170, 175, 199, 244, 295, 337, 358, 405, 418, 452, 501, 519, 538, 549]

[NC-25] Custom errors has no error details

Consider adding parameters to the error to indicate which user or values caused the failure.

There are 36 instances (click to show):

File: governance/contracts/OLAS.sol

12: error ZeroAddress();

Github: [12]

File: governance/contracts/bridges/BridgedERC20.sol

12: error ZeroAddress();

Github: [12]

File: governance/contracts/bridges/FxERC20ChildTunnel.sol

8: error ZeroAddress();

11: error ZeroValue();

Github: [8, 11]

File: governance/contracts/bridges/FxERC20RootTunnel.sol

8: error ZeroAddress();

11: error ZeroValue();

Github: [8, 11]

File: governance/contracts/bridges/FxGovernorTunnel.sol

10: error ZeroAddress();

Github: [10]

File: governance/contracts/bridges/HomeMediator.sol

10: error ZeroAddress();

Github: [10]

File: governance/contracts/interfaces/IErrors.sol

12:     error ZeroAddress();

15:     error ZeroValue();

18:     error NonZeroValue();

Github: [12, 15, 18]

File: governance/contracts/multisigs/GuardCM.sol

33: error ZeroAddress();

36: error ZeroValue();

55: error NoDelegateCall();

58: error NoSelfCall();

Github: [33, 36, 55, 58]

File: governance/contracts/wveOLAS.sol

108: error ZeroAddress();

Github: [108]

File: registries/contracts/interfaces/IErrorsRegistries.sol

17:     error HashExists();

20:     error ZeroAddress();

64:     error Paused();

67:     error ZeroValue();

117:     error ReentrancyGuard();

Github: [17, 20, 64, 67, 117]

File: registries/contracts/multisigs/GnosisSafeSameAddressMultisig.sol

16: error ZeroValue();

19: error ZeroAddress();

Github: [16, 19]

File: tokenomics/contracts/DonatorBlacklist.sol

10: error ZeroAddress();

Github: [10]

File: tokenomics/contracts/GenericBondCalculator.sol

14: error ZeroAddress();

Github: [14]

File: tokenomics/contracts/TokenomicsProxy.sol

5: error InitializationFailed();

8: error ZeroTokenomicsAddress();

11: error ZeroTokenomicsData();

Github: [5, 8, 11]

File: tokenomics/contracts/interfaces/IErrorsTokenomics.sol

17:     error ZeroAddress();

29:     error ZeroValue();

32:     error NonZeroValue();

103:     error ReentrancyGuard();

119:     error AlreadyInitialized();

122:     error DelegatecallOnly();

125:     error Paused();

128:     error SameBlockNumberViolation();

Github: [17, 29, 32, 103, 119, 122, 125, 128]

[NC-26] Solidity version is different in some files

There are 2 instances of this issue:

File: governance/contracts/GovernorOLAS.sol

2: pragma solidity ^0.8.20;

Github: [2]

File: governance/contracts/OLAS.sol

2: pragma solidity ^0.8.15;

Github: [2]

[NC-27] Polymorphic functions make security audits more time-consuming and error-prone

The instances below point to one of two functions with the same name. Consider naming each function differently, in order to make code navigation and analysis easier.

There are 20 instances (click to show):

File: governance/contracts/bridges/FxGovernorTunnel.sol

/// @audit also found on line 107
6:     function processMessageFromRoot(uint256 stateId, address rootMessageSender, bytes memory data) external;

Github: [6]

File: governance/contracts/wveOLAS.sol

/// @audit also found on line 156
16:     function totalNumPoints() external view returns (uint256 numPoints);

/// @audit also found on line 163
21:     function mapSupplyPoints(uint256 idx) external view returns (PointVoting memory sPoint);

/// @audit also found on line 170
26:     function mapSlopeChanges(uint64 ts) external view returns (int128 slopeChange);

/// @audit also found on line 177
31:     function getLastUserPoint(address account) external view returns (PointVoting memory pv);

/// @audit also found on line 184
36:     function getNumUserPoints(address account) external view returns (uint256 userNumPoints);

/// @audit also found on line 193
43:     function getUserPoint(address account, uint256 idx) external view returns (PointVoting memory uPoint);

/// @audit also found on line 211
49:     function getPastVotes(address account, uint256 blockNumber) external view returns (uint256 balance);

/// @audit also found on line 223
54:     function balanceOf(address account) external view returns (uint256 balance);

/// @audit also found on line 231
60:     function balanceOfAt(address account, uint256 blockNumber) external view returns (uint256 balance);

/// @audit also found on line 243
65:     function lockedEnd(address account) external view returns (uint256 unlockTime);

/// @audit also found on line 203
70:     function getVotes(address account) external view returns (uint256 balance);

/// @audit also found on line 249
74:     function totalSupply() external view returns (uint256 supply);

/// @audit also found on line 256
79:     function totalSupplyAt(uint256 blockNumber) external view returns (uint256 supplyAt);

/// @audit also found on line 263
84:     function totalSupplyLockedAtT(uint256 ts) external view returns (uint256 vPower);

/// @audit also found on line 277
88:     function totalSupplyLocked() external view returns (uint256 vPower);

/// @audit also found on line 285
93:     function getPastTotalSupply(uint256 blockNumber) external view returns (uint256 vPower);

/// @audit also found on line 292
98:     function supportsInterface(bytes4 interfaceId) external view returns (bool);

/// @audit also found on line 312
101:     function allowance(address owner, address spender) external view returns (uint256);

/// @audit also found on line 317
104:     function delegates(address account) external view returns (address);

Github: [16, 21, 26, 31, 36, 43, 49, 54, 60, 65, 70, 74, 79, 84, 88, 93, 98, 101, 104]

[NC-28] Duplicated `require()`/`revert()` checks should be refactored

Refactoring duplicate require()/revert() checks into a modifier or function can make the code more concise, readable and maintainable, and less likely to make errors or omissions when modifying the require() or revert().

There are 57 instances (click to show):

File: governance/contracts/OLAS.sol

/// @audit duplicated on line 60
45:             revert ManagerOnly(msg.sender, owner);

/// @audit duplicated on line 64
49:             revert ZeroAddress();

Github: [45, 49]

File: governance/contracts/bridges/BridgedERC20.sol

/// @audit duplicated on line 51
33:             revert OwnerOnly(msg.sender, owner);

Github: [33]

File: governance/contracts/bridges/FxERC20ChildTunnel.sol

/// @audit duplicated on line 60
40:             revert ZeroAddress();

Github: [40]

File: governance/contracts/bridges/FxERC20RootTunnel.sol

/// @audit duplicated on line 64
44:             revert ZeroAddress();

Github: [44]

File: governance/contracts/bridges/FxGovernorTunnel.sol

/// @audit duplicated on line 90
65:             revert ZeroAddress();

Github: [65]

File: governance/contracts/bridges/HomeMediator.sol

/// @audit duplicated on line 90
65:             revert ZeroAddress();

Github: [65]

File: governance/contracts/multisigs/GuardCM.sol

/// @audit duplicated on line 161
145:             revert ZeroAddress();

/// @audit duplicated on line 172
156:             revert OwnerOnly(msg.sender, owner);

/// @audit duplicated on line 466
177:             revert ZeroValue();

/// @audit duplicated on line 461
227:                 revert ZeroAddress();

/// @audit duplicated on line 287
263:                 revert WrongSelector(functionSig, chainId);

/// @audit duplicated on line 502
449:             revert OwnerOnly(msg.sender, owner);

Github: [145, 156, 177, 227, 263, 449]

File: governance/contracts/veOLAS.sol

/// @audit duplicated on line 428
380:             revert ZeroValue();

/// @audit duplicated on line 470
388:             revert LockExpired(msg.sender, lockedBalance.endTime, block.timestamp);

/// @audit duplicated on line 450
393:             revert Overflow(amount, type(uint96).max);

/// @audit duplicated on line 491
466:             revert NoValueLocked(msg.sender);

/// @audit duplicated on line 773
768:         revert NonTransferable(address(this));

/// @audit duplicated on line 784
778:         revert NonTransferable(address(this));

/// @audit duplicated on line 796
790:         revert NonDelegatable(address(this));

Github: [380, 388, 393, 466, 768, 778, 790]

File: governance/contracts/wveOLAS.sol

/// @audit duplicated on line 303
298:         revert NonTransferable(ve);

/// @audit duplicated on line 313
308:         revert NonTransferable(ve);

/// @audit duplicated on line 324
318:         revert NonDelegatable(ve);

Github: [298, 308, 318]

File: registries/contracts/GenericManager.sol

/// @audit duplicated on line 39
23:             revert OwnerOnly(msg.sender, owner);

Github: [23]

File: registries/contracts/GenericRegistry.sol

/// @audit duplicated on line 56
40:             revert OwnerOnly(msg.sender, owner);

/// @audit duplicated on line 61
45:             revert ZeroAddress();

Github: [40, 45]

File: registries/contracts/UnitRegistry.sol

/// @audit duplicated on line 126
60:             revert ManagerOnly(msg.sender, manager);

/// @audit duplicated on line 140
70:             revert ZeroValue();

Github: [60, 70]

File: tokenomics/contracts/Depository.sol

/// @audit duplicated on line 131
112:             revert ZeroAddress();

/// @audit duplicated on line 146
126:             revert OwnerOnly(msg.sender, owner);

/// @audit duplicated on line 186
166:             revert OwnerOnly(msg.sender, owner);

/// @audit duplicated on line 201
191:             revert ZeroValue();

/// @audit duplicated on line 312
217:             revert Overflow(maturity, type(uint32).max);

/// @audit duplicated on line 385
296:             revert ZeroValue();

Github: [112, 126, 166, 191, 217, 296]

File: tokenomics/contracts/Dispenser.sol

/// @audit duplicated on line 54
37:             revert ZeroAddress();

/// @audit duplicated on line 67
49:             revert OwnerOnly(msg.sender, owner);

Github: [37, 49]

File: tokenomics/contracts/DonatorBlacklist.sol

/// @audit duplicated on line 59
39:             revert OwnerOnly(msg.sender, owner);

/// @audit duplicated on line 70
44:             revert ZeroAddress();

Github: [39, 44]

File: tokenomics/contracts/Tokenomics.sol

/// @audit duplicated on line 392
286:             revert ZeroAddress();

/// @audit duplicated on line 407
387:             revert OwnerOnly(msg.sender, owner);

/// @audit duplicated on line 453
426:             revert OwnerOnly(msg.sender, owner);

/// @audit duplicated on line 507
477:             revert OwnerOnly(msg.sender, owner);

/// @audit duplicated on line 633
612:             revert ManagerOnly(msg.sender, depository);

/// @audit duplicated on line 1165
1095:             revert WrongArrayLength(unitTypes.length, unitIds.length);

/// @audit duplicated on line 1183
1113:                 revert Overflow(unitTypes[i], 1);

/// @audit duplicated on line 1188
1118:                 revert WrongUnitId(unitIds[i], unitTypes[i]);

/// @audit duplicated on line 1195
1125:                 revert OwnerOnly(unitOwner, account);

Github: [286, 387, 426, 477, 612, 1095, 1113, 1118, 1125]

File: tokenomics/contracts/Treasury.sol

/// @audit duplicated on line 145
101:             revert ZeroAddress();

/// @audit duplicated on line 266
122:             revert LowerThan(msg.value, minAcceptedETH);

/// @audit duplicated on line 159
140:             revert OwnerOnly(msg.sender, owner);

/// @audit duplicated on line 316
185:             revert OwnerOnly(msg.sender, owner);

/// @audit duplicated on line 278
190:             revert ZeroValue();

/// @audit duplicated on line 350
220:             revert UnauthorizedToken(token);

/// @audit duplicated on line 364
321:             revert TransferFailed(token, address(this), to, tokenAmount);

/// @audit duplicated on line 431
392:             revert Paused();

/// @audit duplicated on line 490
469:             revert OwnerOnly(msg.sender, owner);

/// @audit duplicated on line 534
510:             revert OwnerOnly(msg.sender, owner);

Github: [101, 122, 140, 185, 190, 220, 321, 392, 469, 510]

[NC-29] Empty bytes check is missing

Passing empty bytes to a function can cause unexpected behavior, such as certain operations failing, producing incorrect results, or wasting gas. It is recommended to check that all byte parameters are not empty.

There are 15 instances (click to show):

File: governance/contracts/bridges/FxERC20ChildTunnel.sol

/// @audit missing empty check for `message`
70:     function _processMessageFromRoot(
            uint256 /* stateId */,
            address sender,
            bytes memory message
        ) internal override validateSender(sender) {

Github: [70]

File: governance/contracts/bridges/FxERC20RootTunnel.sol

/// @audit missing empty check for `message`
72:     function _processMessageFromChild(bytes memory message) internal override {

Github: [72]

File: governance/contracts/bridges/FxGovernorTunnel.sol

/// @audit missing empty check for `data`
6:     function processMessageFromRoot(uint256 stateId, address rootMessageSender, bytes memory data) external;

/// @audit missing empty check for `data`
107:     function processMessageFromRoot(uint256 stateId, address rootMessageSender, bytes memory data) external override {

Github: [6, 107]

File: governance/contracts/bridges/HomeMediator.sol

/// @audit missing empty check for `data`
105:     function processMessageFromForeign(bytes memory data) external {

Github: [105]

File: governance/contracts/multisigs/GuardCM.sol

/// @audit missing empty check for `data`
189:     function _verifyData(address target, bytes memory data, uint256 chainId) internal {

/// @audit missing empty check for `data`
209:     function _verifyBridgedData(bytes memory data, uint256 chainId) internal {

/// @audit missing empty check for `data`
252:     function _processBridgeData(
             bytes memory data,
             address bridgeMediatorL2,
             uint256 chainId
         ) internal
         {

/// @audit missing empty check for `data`
337:     function _verifySchedule(bytes memory data, bytes4 selector) internal {

/// @audit missing empty check for `data`
/// @audit missing empty check for ``
387:     function checkTransaction(
             address to,
             uint256,
             bytes memory data,
             Enum.Operation operation,
             uint256,
             uint256,
             uint256,
             address,
             address payable,
             bytes memory,
             address
         ) external {

Github: [189, 209, 252, 337, 387]

File: registries/contracts/multisigs/GnosisSafeMultisig.sol

/// @audit missing empty check for `initializer`
10:     function createProxyWithNonce(

/// @audit missing empty check for `data`
45:     function _parseData(bytes memory data) internal pure
            returns (address to, address fallbackHandler, address paymentToken, address payable paymentReceiver,
                uint256 payment, uint256 nonce, bytes memory payload)
        {

/// @audit missing empty check for `data`
91:     function create(
            address[] memory owners,
            uint256 threshold,
            bytes memory data
        ) external returns (address multisig)
        {

Github: [10, 45, 91]

File: registries/contracts/multisigs/GnosisSafeSameAddressMultisig.sol

/// @audit missing empty check for `data`
85:     function create(
            address[] memory owners,
            uint256 threshold,
            bytes memory data
        ) external returns (address multisig)
        {

Github: [85]

File: tokenomics/contracts/TokenomicsProxy.sol

/// @audit missing empty check for `tokenomicsData`
33:     constructor(address tokenomics, bytes memory tokenomicsData) {

Github: [33]

[NC-30] Enable IR-based code generation

The IR-based code generator was introduced with an aim to not only allow code generation to be more transparent and auditable but also to enable more powerful optimization passes that span across functions. You can enable it on the command line using --via-ir or with the option {"viaIR": true}. This will take longer to compile, but you can just simple test it before deploying and if you got a better benchmark then you can add --via-ir to your deploy command More on: https://docs.soliditylang.org/en/v0.8.17/ir-breaking-changes.html

There is one instance of this issue:

Global finding

Github: [Global]

[NC-31] Enum values should be used instead of constant array indexes

Create a commented enum value to use instead of constant array indexes, this makes the code far easier to understand.

There are 56 instances (click to show):

File: governance/contracts/multisigs/GuardCM.sol

351:             (targets[0], , callDatas[0], , , ) =

351:             (targets[0], , callDatas[0], , , ) =

Github: [351, 351]

File: governance/contracts/veOLAS.sol

139:         mapSupplyPoints[0] = PointVoting(0, 0, uint64(block.timestamp), uint64(block.number), 0);

Github: [139]

File: tokenomics/contracts/Tokenomics.sol

334:         mapEpochTokenomics[0].epochPoint.endTime = uint32(block.timestamp);

338:         TokenomicsPoint storage tp = mapEpochTokenomics[1];

348:         tp.unitPoints[0].rewardUnitFraction = 83;

349:         tp.unitPoints[1].rewardUnitFraction = 17;

362:         tp.unitPoints[0].topUpUnitFraction = 41;

363:         tp.unitPoints[1].topUpUnitFraction = 9;

589:         tp.unitPoints[0].rewardUnitFraction = uint8(_rewardComponentFraction);

590:         tp.unitPoints[1].rewardUnitFraction = uint8(_rewardAgentFraction);

595:         tp.unitPoints[0].topUpUnitFraction = uint8(_topUpComponentFraction);

596:         tp.unitPoints[1].topUpUnitFraction = uint8(_topUpAgentFraction);

690:         (registries[0], registries[1]) = (componentRegistry, agentRegistry);

690:         (registries[0], registries[1]) = (componentRegistry, agentRegistry);

694:         incentiveFlags[0] = (mapEpochTokenomics[curEpoch].unitPoints[0].rewardUnitFraction > 0);

694:         incentiveFlags[0] = (mapEpochTokenomics[curEpoch].unitPoints[0].rewardUnitFraction > 0);

695:         incentiveFlags[1] = (mapEpochTokenomics[curEpoch].unitPoints[1].rewardUnitFraction > 0);

695:         incentiveFlags[1] = (mapEpochTokenomics[curEpoch].unitPoints[1].rewardUnitFraction > 0);

696:         incentiveFlags[2] = (mapEpochTokenomics[curEpoch].unitPoints[0].topUpUnitFraction > 0);

696:         incentiveFlags[2] = (mapEpochTokenomics[curEpoch].unitPoints[0].topUpUnitFraction > 0);

697:         incentiveFlags[3] = (mapEpochTokenomics[curEpoch].unitPoints[1].topUpUnitFraction > 0);

697:         incentiveFlags[3] = (mapEpochTokenomics[curEpoch].unitPoints[1].topUpUnitFraction > 0);

707:             if (incentiveFlags[2] || incentiveFlags[3]) {

707:             if (incentiveFlags[2] || incentiveFlags[3]) {

914:         incentives[0] = tp.epochPoint.totalDonationsETH;

915:         incentives[1] = (incentives[0] * tp.epochPoint.rewardTreasuryFraction) / 100;

915:         incentives[1] = (incentives[0] * tp.epochPoint.rewardTreasuryFraction) / 100;

917:         incentives[2] = (incentives[0] * tp.unitPoints[0].rewardUnitFraction) / 100;

917:         incentives[2] = (incentives[0] * tp.unitPoints[0].rewardUnitFraction) / 100;

917:         incentives[2] = (incentives[0] * tp.unitPoints[0].rewardUnitFraction) / 100;

918:         incentives[3] = (incentives[0] * tp.unitPoints[1].rewardUnitFraction) / 100;

918:         incentives[3] = (incentives[0] * tp.unitPoints[1].rewardUnitFraction) / 100;

918:         incentives[3] = (incentives[0] * tp.unitPoints[1].rewardUnitFraction) / 100;

951:         incentives[4] = (inflationPerEpoch * tp.epochPoint.maxBondFraction) / 100;

963:         if (incentives[4] > curMaxBond) {

965:             incentives[4] = effectiveBond + incentives[4] - curMaxBond;

965:             incentives[4] = effectiveBond + incentives[4] - curMaxBond;

966:             effectiveBond = uint96(incentives[4]);

1041:         if (incentives[0] > 0) {

1043:             uint256 idf = _calculateIDF(incentives[1], tp.epochPoint.numNewOwners);

1052:         uint256 accountRewards = incentives[2] + incentives[3];

1052:         uint256 accountRewards = incentives[2] + incentives[3];

1054:         incentives[5] = (inflationPerEpoch * tp.unitPoints[0].topUpUnitFraction) / 100;

1054:         incentives[5] = (inflationPerEpoch * tp.unitPoints[0].topUpUnitFraction) / 100;

1056:         incentives[6] = (inflationPerEpoch * tp.unitPoints[1].topUpUnitFraction) / 100;

1056:         incentives[6] = (inflationPerEpoch * tp.unitPoints[1].topUpUnitFraction) / 100;

1060:         uint256 accountTopUps = incentives[5] + incentives[6];

1060:         uint256 accountTopUps = incentives[5] + incentives[6];

1063:         if (incentives[1] == 0 || ITreasury(treasury).rebalanceTreasury(incentives[1])) {

1063:         if (incentives[1] == 0 || ITreasury(treasury).rebalanceTreasury(incentives[1])) {

1065:             emit EpochSettled(eCounter, incentives[1], accountRewards, accountTopUps);

1100:         (registries[0], registries[1]) = (componentRegistry, agentRegistry);

1100:         (registries[0], registries[1]) = (componentRegistry, agentRegistry);

1170:         (registries[0], registries[1]) = (componentRegistry, agentRegistry);

1170:         (registries[0], registries[1]) = (componentRegistry, agentRegistry);

Github: [334, 338, 348, 349, 362, 363, 589, 590, 595, 596, 690, 690, 694, 694, 695, 695, 696, 696, 697, 697, 707, 707, 914, 915, 915, 917, 917, 917, 918, 918, 918, 951, 963, 965, 965, 966, 1041, 1043, 1052, 1052, 1054, 1054, 1056, 1056, 1060, 1060, 1063, 1063, 1065, 1100, 1100, 1170, 1170]

[NC-32] Events are emitted without the sender information

When an action is triggered based on a user's action, not being able to filter based on who triggered the action makes event processing a lot more cumbersome. Including the msg.sender the events of these types of action will make events much more useful to end users, especially when msg.sender is not tx.origin.

There are 35 instances (click to show):

File: governance/contracts/OLAS.sol

53:         emit OwnerUpdated(newOwner);

68:         emit MinterUpdated(newMinter);

Github: [53, 68]

File: governance/contracts/bridges/BridgedERC20.sol

42:         emit OwnerUpdated(newOwner);

Github: [42]

File: governance/contracts/bridges/FxERC20ChildTunnel.sol

84:         emit FxWithdrawERC20(rootToken, childToken, from, to, amount);

Github: [84]

File: governance/contracts/bridges/FxERC20RootTunnel.sol

79:         emit FxDepositERC20(childToken, rootToken, from, to, amount);

Github: [79]

File: governance/contracts/bridges/FxGovernorTunnel.sol

94:         emit RootGovernorUpdated(newRootGovernor);

167:         emit MessageReceived(stateId, rootMessageSender, data);

Github: [94, 167]

File: governance/contracts/bridges/HomeMediator.sol

94:         emit ForeignGovernorUpdated(newForeignGovernor);

167:         emit MessageReceived(governor, data);

Github: [94, 167]

File: governance/contracts/multisigs/GuardCM.sol

165:         emit GovernorUpdated(newGovernor);

181:         emit GovernorCheckProposalIdChanged(proposalId);

486:         emit SetTargetSelectors(targets, selectors, chainIds, statuses);

531:         emit SetBridgeMediators(bridgeMediatorL1s, bridgeMediatorL2s, chainIds);

Github: [165, 181, 486, 531]

File: governance/contracts/veOLAS.sol

367:         emit Deposit(account, amount, lockedBalance.endTime, depositType, block.timestamp);

368:         emit Supply(supplyBefore, supplyAfter);

531:         emit Supply(supplyBefore, supplyAfter);

Github: [367, 368, 531]

File: registries/contracts/GenericManager.sol

32:         emit OwnerUpdated(newOwner);

Github: [32]

File: registries/contracts/GenericRegistry.sol

49:         emit OwnerUpdated(newOwner);

65:         emit ManagerUpdated(newManager);

90:         emit BaseURIChanged(bURI);

Github: [49, 65, 90]

File: registries/contracts/UnitRegistry.sol

112:         emit CreateUnit(unitId, unitType, unitHash);

146:         emit UpdateUnitHash(unitId, unitType, unitHash);

Github: [112, 146]

File: tokenomics/contracts/Depository.sol

135:         emit OwnerUpdated(newOwner);

235:         emit CreateProduct(token, productId, supply, priceLP, vesting);

Github: [135, 235]

File: tokenomics/contracts/Dispenser.sol

58:         emit OwnerUpdated(newOwner);

Github: [58]

File: tokenomics/contracts/DonatorBlacklist.sol

48:         emit OwnerUpdated(newOwner);

Github: [48]

File: tokenomics/contracts/Tokenomics.sol

399:         emit TokenomicsImplementationUpdated(implementation);

416:         emit OwnerUpdated(newOwner);

481:         emit DonatorBlacklistUpdated(_donatorBlacklist);

551:         emit TokenomicsParametersUpdateRequested(epochCounter + 1, _devsPerCapital, _codePerDev, _epsilonRate, _epochLen,

600:         emit IncentiveFractionsUpdateRequested(eCounter, _rewardComponentFraction, _rewardAgentFraction,

643:         emit EffectiveBondUpdated(eBond);

Github: [399, 416, 481, 551, 600, 643]

File: tokenomics/contracts/Treasury.sol

149:         emit OwnerUpdated(newOwner);

199:         emit MinAcceptedETHUpdated(_minAcceptedETH);

244:         emit DepositTokenFromAccount(account, token, tokenAmount, olasMintAmount);

Github: [149, 199, 244]

[NC-33] Events may be emitted out of order due to reentrancy

Ensure that events follow the best practice of check-effects-interaction, and are emitted before external calls.

There are 16 instances (click to show):

File: governance/contracts/bridges/FxERC20ChildTunnel.sol

/// @audit `.transfer(...)` is called on line 79
84:         emit FxWithdrawERC20(rootToken, childToken, from, to, amount);

/// @audit `.transferFrom(...)` is called on line 102
107:         emit FxDepositERC20(childToken, rootToken, msg.sender, to, amount);

Github: [84, 107]

File: governance/contracts/bridges/FxERC20RootTunnel.sol

/// @audit `.mint(...)` is called on line 77
79:         emit FxDepositERC20(childToken, rootToken, from, to, amount);

/// @audit `.transferFrom(...)` is called on line 98
/// @audit `.burn(...)` is called on line 104
106:         emit FxWithdrawERC20(rootToken, childToken, msg.sender, to, amount);

Github: [79, 106]

File: governance/contracts/bridges/HomeMediator.sol

/// @audit `.messageSender(...)` is called on line 113
167:         emit MessageReceived(governor, data);

Github: [167]

File: governance/contracts/multisigs/GuardCM.sol

/// @audit `.state(...)` is called on line 545
556:         emit GuardPaused(msg.sender);

Github: [556]

File: governance/contracts/veOLAS.sol

/// @audit `.transferFrom(...)` is called on line 364
367:         emit Deposit(account, amount, lockedBalance.endTime, depositType, block.timestamp);

/// @audit `.transferFrom(...)` is called on line 364
368:         emit Supply(supplyBefore, supplyAfter);

Github: [367, 368]

File: tokenomics/contracts/Depository.sol

/// @audit `.isEnabled(...)` is called on line 221
/// @audit `.reserveAmountForBondProgram(...)` is called on line 226
/// @audit `.effectiveBond(...)` is called on line 227
235:         emit CreateProduct(token, productId, supply, priceLP, vesting);

/// @audit `.refundFromBondProgram(...)` is called on line 262
268:                 emit CloseProduct(token, productId, supply);

/// @audit `.calculatePayoutOLAS(...)` is called on line 320
/// @audit `.depositTokenForOLAS(...)` is called on line 337
342:             emit CloseProduct(token, productId, supply);

/// @audit `.calculatePayoutOLAS(...)` is called on line 320
/// @audit `.depositTokenForOLAS(...)` is called on line 337
345:         emit CreateBond(token, productId, msg.sender, bondId, payout, tokenAmount, maturity);

Github: [235, 268, 342, 345]

File: tokenomics/contracts/Dispenser.sol

/// @audit `.accountOwnerIncentives(...)` is called on line 99
/// @audit `.withdrawToAccount(...)` is called on line 104
112:         emit IncentivesClaimed(msg.sender, reward, topUp);

Github: [112]

File: tokenomics/contracts/Tokenomics.sol

/// @audit `.rebalanceTreasury(...)` is called on line 1063
1065:             emit EpochSettled(eCounter, incentives[1], accountRewards, accountTopUps);

Github: [1065]

File: tokenomics/contracts/Treasury.sol

/// @audit `.allowance(...)` is called on line 228
/// @audit `.allowance(...)` is called on line 229
/// @audit `.transferFrom(...)` is called on line 235
/// @audit `.mint(...)` is called on line 242
244:         emit DepositTokenFromAccount(account, token, tokenAmount, olasMintAmount);

/// @audit `.mint(...)` is called on line 416
418:             emit Withdraw(olas, account, accountTopUps);

Github: [244, 418]

[NC-34] Events should use parameters to convey information

For example, rather than using event Paused() and event Unpaused(), use event PauseState(address indexed whoChangedIt, bool wasPaused, bool isNowPaused)

There are 3 instances of this issue:

File: governance/contracts/multisigs/GuardCM.sol

94:     event GuardUnpaused();

Github: [94]

File: tokenomics/contracts/Treasury.sol

51:     event PauseTreasury();

52:     event UnpauseTreasury();

Github: [51, 52]

[NC-35] Execution at deadlines should be allowed

The condition may be wrong in these cases, as when block.timestamp is equal to the compared > or < variable these blocks will not be executed.

There are 9 instances of this issue:

File: governance/contracts/veOLAS.sol

188:             if (oldLocked.endTime > block.timestamp && oldLocked.amount > 0) {

192:             if (newLocked.endTime > block.timestamp && newLocked.amount > 0) {

222:         if (block.timestamp > lastPoint.ts) {

240:                 if (tStep > block.timestamp) {

297:             if (oldLocked.endTime > block.timestamp) {

306:             if (newLocked.endTime > block.timestamp && newLocked.endTime > oldLocked.endTime) {

445:         if (unlockTime > block.timestamp + MAXTIME) {

502:         if (unlockTime > block.timestamp + MAXTIME) {

512:         if (lockedBalance.endTime > block.timestamp) {

Github: [188, 192, 222, 240, 297, 306, 445, 502, 512]

[NC-36] Function ordering does not follow the Solidity Style Guide

According to the solidity style guide, functions should be laid out in the following order: constructor(), receive(), fallback(), external, public, internal, private, but the cases below do not follow this pattern

There are 98 instances (click to show):

File: governance/contracts/GovernorOLAS.sol

/// @audit internal function `_execute` came earlier from this public function
/// @audit internal function `_cancel` came earlier from this public function
/// @audit internal function `_executor` came earlier from this public function
105:     function supportsInterface(bytes4 interfaceId) public view override(IERC165, Governor, GovernorTimelockControl)

Github: [105]

File: governance/contracts/OLAS.sol

/// @audit public function `inflationControl` came earlier from this external function
/// @audit public function `inflationRemainder` came earlier from this external function
118:     function burn(uint256 amount) external {

/// @audit public function `inflationControl` came earlier from this external function
/// @audit public function `inflationRemainder` came earlier from this external function
128:     function decreaseAllowance(address spender, uint256 amount) external returns (bool) {

/// @audit public function `inflationControl` came earlier from this external function
/// @audit public function `inflationRemainder` came earlier from this external function
145:     function increaseAllowance(address spender, uint256 amount) external returns (bool) {

Github: [118, 128, 145]

File: governance/contracts/bridges/FxGovernorTunnel.sol

/// @audit a function was seen before constructor
62:     constructor(address _fxChild, address _rootGovernor) {

/// @audit a function was seen before receive()
73:     receive() external payable {

Github: [62, 73]

File: governance/contracts/bridges/HomeMediator.sol

/// @audit a function was seen before constructor
62:     constructor(address _AMBContractProxyHome, address _foreignGovernor) {

/// @audit a function was seen before receive()
73:     receive() external payable {

Github: [62, 73]

File: governance/contracts/multisigs/GuardCM.sol

/// @audit a function was seen before constructor
138:     constructor(

/// @audit internal function `_verifyData` came earlier from this external function
/// @audit internal function `_verifyBridgedData` came earlier from this external function
/// @audit internal function `_processBridgeData` came earlier from this external function
/// @audit internal function `_verifySchedule` came earlier from this external function
387:     function checkTransaction(

/// @audit internal function `_verifyData` came earlier from this external function
/// @audit internal function `_verifyBridgedData` came earlier from this external function
/// @audit internal function `_processBridgeData` came earlier from this external function
/// @audit internal function `_verifySchedule` came earlier from this external function
441:     function setTargetSelectorChainIds(

/// @audit internal function `_verifyData` came earlier from this external function
/// @audit internal function `_verifyBridgedData` came earlier from this external function
/// @audit internal function `_processBridgeData` came earlier from this external function
/// @audit internal function `_verifySchedule` came earlier from this external function
495:     function setBridgeMediatorChainIds(

/// @audit internal function `_verifyData` came earlier from this external function
/// @audit internal function `_verifyBridgedData` came earlier from this external function
/// @audit internal function `_processBridgeData` came earlier from this external function
/// @audit internal function `_verifySchedule` came earlier from this external function
539:     function pause() external {

/// @audit internal function `_verifyData` came earlier from this external function
/// @audit internal function `_verifyBridgedData` came earlier from this external function
/// @audit internal function `_processBridgeData` came earlier from this external function
/// @audit internal function `_verifySchedule` came earlier from this external function
560:     function unpause() external {

/// @audit internal function `_verifyData` came earlier from this external function
/// @audit internal function `_verifyBridgedData` came earlier from this external function
/// @audit internal function `_processBridgeData` came earlier from this external function
/// @audit internal function `_verifySchedule` came earlier from this external function
572:     function checkAfterExecution(bytes32, bool) external {}

/// @audit internal function `_verifyData` came earlier from this external function
/// @audit internal function `_verifyBridgedData` came earlier from this external function
/// @audit internal function `_processBridgeData` came earlier from this external function
/// @audit internal function `_verifySchedule` came earlier from this external function
579:     function getTargetSelectorChainId(address target, bytes4 selector, uint256 chainId) external view

/// @audit internal function `_verifyData` came earlier from this external function
/// @audit internal function `_verifyBridgedData` came earlier from this external function
/// @audit internal function `_processBridgeData` came earlier from this external function
/// @audit internal function `_verifySchedule` came earlier from this external function
597:     function getBridgeMediatorChainId(address bridgeMediatorL1) external view

Github: [138, 387, 441, 495, 539, 560, 572, 579, 597]

File: governance/contracts/veOLAS.sol

/// @audit internal function `_checkpoint` came earlier from this external function
320:     function checkpoint() external {

/// @audit internal function `_checkpoint` came earlier from this external function
/// @audit internal function `_depositFor` came earlier from this external function
376:     function depositFor(address account, uint256 amount) external {

/// @audit internal function `_checkpoint` came earlier from this external function
/// @audit internal function `_depositFor` came earlier from this external function
402:     function createLock(uint256 amount, uint256 unlockTime) external {

/// @audit internal function `_checkpoint` came earlier from this external function
/// @audit internal function `_depositFor` came earlier from this external function
411:     function createLockFor(address account, uint256 amount, uint256 unlockTime) external {

/// @audit internal function `_checkpoint` came earlier from this external function
/// @audit internal function `_depositFor` came earlier from this external function
/// @audit private function `_createLockFor` came earlier from this external function
458:     function increaseAmount(uint256 amount) external {

/// @audit internal function `_checkpoint` came earlier from this external function
/// @audit internal function `_depositFor` came earlier from this external function
/// @audit private function `_createLockFor` came earlier from this external function
483:     function increaseUnlockTime(uint256 unlockTime) external {

/// @audit internal function `_checkpoint` came earlier from this external function
/// @audit internal function `_depositFor` came earlier from this external function
/// @audit private function `_createLockFor` came earlier from this external function
510:     function withdraw() external {

/// @audit private function `_createLockFor` came earlier from this internal function
542:     function _findPointByBlock(uint256 blockNumber, address account) internal view

/// @audit private function `_createLockFor` came earlier from this internal function
593:     function _balanceOfLocked(address account, uint64 ts) internal view returns (uint256 vBalance) {

/// @audit internal function `_checkpoint` came earlier from this public function
/// @audit internal function `_depositFor` came earlier from this public function
/// @audit private function `_createLockFor` came earlier from this public function
/// @audit internal function `_findPointByBlock` came earlier from this public function
/// @audit internal function `_balanceOfLocked` came earlier from this public function
607:     function balanceOf(address account) public view override returns (uint256 balance) {

/// @audit internal function `_checkpoint` came earlier from this external function
/// @audit internal function `_depositFor` came earlier from this external function
/// @audit private function `_createLockFor` came earlier from this external function
/// @audit internal function `_findPointByBlock` came earlier from this external function
/// @audit internal function `_balanceOfLocked` came earlier from this external function
/// @audit public function `balanceOf` came earlier from this external function
614:     function lockedEnd(address account) external view returns (uint256 unlockTime) {

/// @audit internal function `_checkpoint` came earlier from this external function
/// @audit internal function `_depositFor` came earlier from this external function
/// @audit private function `_createLockFor` came earlier from this external function
/// @audit internal function `_findPointByBlock` came earlier from this external function
/// @audit internal function `_balanceOfLocked` came earlier from this external function
/// @audit public function `balanceOf` came earlier from this external function
622:     function balanceOfAt(address account, uint256 blockNumber) external view returns (uint256 balance) {

/// @audit internal function `_checkpoint` came earlier from this public function
/// @audit internal function `_depositFor` came earlier from this public function
/// @audit private function `_createLockFor` came earlier from this public function
/// @audit internal function `_findPointByBlock` came earlier from this public function
/// @audit internal function `_balanceOfLocked` came earlier from this public function
633:     function getVotes(address account) public view override returns (uint256) {

/// @audit private function `_createLockFor` came earlier from this internal function
643:     function _getBlockTime(uint256 blockNumber) internal view returns (PointVoting memory point, uint256 blockTime) {

/// @audit internal function `_checkpoint` came earlier from this public function
/// @audit internal function `_depositFor` came earlier from this public function
/// @audit private function `_createLockFor` came earlier from this public function
/// @audit internal function `_findPointByBlock` came earlier from this public function
/// @audit internal function `_balanceOfLocked` came earlier from this public function
/// @audit internal function `_getBlockTime` came earlier from this public function
672:     function getPastVotes(address account, uint256 blockNumber) public view override returns (uint256 balance) {

/// @audit private function `_createLockFor` came earlier from this internal function
690:     function _supplyLockedAt(PointVoting memory lastPoint, uint64 ts) internal view returns (uint256 vSupply) {

/// @audit internal function `_checkpoint` came earlier from this public function
/// @audit internal function `_depositFor` came earlier from this public function
/// @audit private function `_createLockFor` came earlier from this public function
/// @audit internal function `_find

0xCRC32/test

About

Resources

Stars

Watchers

Forks

Releases

Packages 0

Packages