QA Report

[code423n4]

Non-Critical Issues

Missing zero-address checks in Yieldy.sol

In Yieldy.sol, all functions except transferFrom() have zero address checks for address parameters. However, transferFrom() is missing zero address checks for _to and _from, making it inconsistent:

    function transferFrom(
        address _from,
        address _to,
        uint256 _value
    ) public override returns (bool) {
        require(_allowances[_from][msg.sender] >= _value, "Allowance too low");

        uint256 newValue = _allowances[_from][msg.sender] - _value; 
        _allowances[_from][msg.sender] = newValue;
        emit Approval(_from, msg.sender, newValue);

        uint256 creditAmount = creditsForTokenBalance(_value);
        creditBalances[_from] = creditBalances[_from] - creditAmount;
        creditBalances[_to] = creditBalances[_to] + creditAmount;
        emit Transfer(_from, _to, _value);

        return true;
    }

Impact

Tokens would become inaccessible if _to is set to address(0).

Recommended Mitigation

Consider adding zero-address checks to _to and _from. Other than preventing users from sending tokens to address(0), it would also help to save gas should _from be set to address(0).

event is missing indexed fields

Each event should use three indexed fields if there are three or more fields:

src/contracts/Yieldy.sol:
  15:        event LogSupply(
  16:            uint256 indexed epoch,
  17:            uint256 timestamp,
  18:            uint256 totalSupply
  19:        );

  21:        event LogRebase(uint256 indexed epoch, uint256 rebase, uint256 index);

src/contracts/Staking.sol:
  36:        event LogSetCurvePool(address indexed curvePool, int128 to, int128 from);