QA Report

[code423n4]

QA (LOW RISK - NON-CRITICAL)

• Different solidity compiler versions used. This leads to potential security flaws between deployed contracts depending on the compiler version chosen for any particular file. It also greatly increases the cost of maintenance as different compiler versions have different semantics and behavior.

• In BalancerV2LPOracle.sol, latestRoundData() method is used, but there is no check if the return value indicates stale data.

• The require statements in AddressProvider.sol, VaultsCore.sol , ABDKMath64x64.sol don't throw error messages on revert.
  When transactions revert, the users won't receive error messages indicating the cause of the failure.

• transfer method is used inside the codebase. Since transfer method uses 2300 gas stipend which is not adjustable,it may likely to get broken in future in case of hardforks causing gas price changes or when calling a contract's fallback function.
  Reference Link -1, Reference Link -2

• block.timestamp is used on many places at the scoped contracts. Hoewever, this can be manipulated by malicious miners.
  Reference