QA Report

[code423n4]

Low

1. Users can create vaults with a malicious token addresses

In Cally.sol a user can call the createVault() function passing in a malicious attacker controlled token as the address token. This will then create a vault setting the evil token address as in storage. Attacker controlled assets should never be allowed in a protocol as they can return arbitrary values when called upon performing other malicious tasks then whats expected.

##POC
https://github.com/code-423n4/2022-05-cally/blob/1849f9ee12434038aa80753266ce6a2f2b082c59/contracts/src/Cally.sol#L160

##Tool Used
Manual Review

##Recommended Mitigation
Consider adding a mapping of approved tokens that can be passed in as an token address to the createVault() function to avoid malicious tokens.

2. Used safeMint() rather than mint()

This POC It can be consider for dev if may necessary for better way

The `_safeMint` can be using if minting causes the recipient of the tokens, if it is a smart contract, to react upon receipt of the tokens.

Here is a general consideration to help decide which one to use:

If YOU are paying for the minting of tokens, use `_mint`. The `_safeMint` might cost you an arbitrary amount of money because of choices made by the recipient of the tokens.

If THEY are paying for the minting of tokens and you expect buyers to be composing functionality with smart contracts, use _safeMint. There is some marginal benefit of allowing the extra features with smart contracts this allows.

If THEY are paying and you expect INDIVIDUAL PEOPLE to buy tokens, then use _mint. The extra features in _safeMint are not expected.

The extra cost from using _safeMint is non-zero. And cost is also always a concern.

since Cally.sol was used to be main actor, it can be used safemint() instead of mint()

##Tool Used
Manual Review

3. Title : comment @return was not set

This was not set information for @return, since other function() was set if @return was used so it can be added for good information to the others.

##Tool Used
Manual Review

Non Critical

4. TItle : Typo Comment

It should be an overrides function but instead of overrides, dev was used ovverides. It can be remain the same, or it can be changed instead.

##Tool Used
Manual Review