QA Report

[code423n4]

1. Add address(0) check to protect from unintended consequences.

• https://github.com/code-423n4/2022-06-connext/blob/b4532655071566b33c41eac46e75be29b4a381ed/contracts/contracts/core/connext/facets/PortalFacet.sol#L57-L59

2. Unused local variable

• https://github.com/code-423n4/2022-06-connext/blob/b4532655071566b33c41eac46e75be29b4a381ed/contracts/contracts/core/connext/facets/PortalFacet.sol#L98
• Variable adopted of repayAavePortal() is not used anywhere.

(bool success, uint256 amountIn, address adopted) = AssetLogic.swapFromLocalAssetIfNeededForExactOut(
      _local,
      totalAmount,
      _maxIn
    );

3. Redundant calculation of sponsoredFee in reimburseRelayerFees()

• https://github.com/code-423n4/2022-06-connext/blob/b4532655071566b33c41eac46e75be29b4a381ed/contracts/contracts/core/connext/helpers/SponsorVault.sol#L246
• https://github.com/code-423n4/2022-06-connext/blob/b4532655071566b33c41eac46e75be29b4a381ed/contracts/contracts/core/connext/helpers/SponsorVault.sol#L253
• sponsoredFee in L246 will revert anyway when den is zero.

function reimburseRelayerFees(......) {
    if (address(gasTokenOracle) != address(0)) {
      (num, den) = gasTokenOracle.getRate(_originDomain);
      // note: this will revert when den == 0
      sponsoredFee = (_originRelayerFee * num) / den;
    } else {
      num = rates[_originDomain].num;
      den = rates[_originDomain].den;
    }

    if (den != 0) {
      sponsoredFee = (_originRelayerFee * num) / den;     
  }

4. Unused function parameters

   --> contracts/core/connext/facets/BridgeFacet.sol:391:5:
    |
391 |     uint32 _nonce,
    |     ^^^^^^^^^^^^^

   --> contracts/core/connext/facets/BridgeFacet.sol:987:5:
    |
987 |     address _router,
    |     ^^^^^^^^^^^^^^^

   --> contracts/core/connext/facets/PortalFacet.sol:128:5:
    |
128 |     address _router, // @qa unused function parameter
    |     ^^^^^^^^^^^^^^^

[jakekidd]

1 invalid, should be able to set to address 0
rest are fine