QA Report

[code423n4]

QA

• get_decimals computation is inefficient. Consider something like this (not tested)

  fn get_decimals(value: Decimal) -> StdResult<Decimal> {
      // gets raw value (in 1e18) and does mod 1e18, construct Decimal from this new raw value
      let raw_fractional_part = value.0.u128() % Decimal::one().0.u128();
      Decimal(raw_fractional_part.into())
  }

• addressproxy.execute: Authenticating on msg.sender (instead of info.sender) in execute is dangerous and it's easy to do mistakes in the future if this code is extended to handle more messages. Consider moving this authentication part to the receive_cw20 function.

• String::from_utf8(denom)? can panic if malicious users provide non-UTF8 strings. The function will revert. Consider using from_utf8_lossy