QA Report

[code423n4]

[L-01] Missing constructor and modifier for contracts using Initializable

Impact

OpenZeppelin recommends adding an empty constructor with the initializer modifier in order to avoid exploits.

File: contracts/proxy/MIMOProxy.sol#L12
12: contract MIMOProxy is IMIMOProxy, Initializable, BoringBatchable {

https://github.com/code-423n4/2022-08-mimo/blob/main/contracts/proxy/MIMOProxy.sol#L12

Recommended Mitigations Steps

Add an empty constructor with the initializer modifier.

OpenZeppelin's main concern is for contracts using UUPSUpgradeable. However, I would still recommend adding it for all contracts using Initializable as an extra layer of security to avoid having to send a transaction to invoke initialize() after the contract is deployed to ensure no one else can initialize.

constructor() initializer {}

[NC-01] Remove floating pragma

Locking the pragma will make sure that the contract does not get deployed using outdated compiler versions.

File: contracts/proxy/MIMOProxy.sol
2: pragma solidity >=0.8.4;

https://github.com/code-423n4/2022-08-mimo/blob/main/contracts/proxy/MIMOProxy.sol

File: contracts/proxy/MIMOProxyFactory.sol
2: pragma solidity >=0.8.4;

https://github.com/code-423n4/2022-08-mimo/blob/main/contracts/proxy/MIMOProxyFactory.sol

File: contracts/proxy/interfaces/IMIMOProxyFactory.sol
2: pragma solidity ^0.8.4;

https://github.com/code-423n4/2022-08-mimo/blob/main/contracts/proxy/interfaces/IMIMOProxyFactory.sol

File: contracts/proxy/interfaces/IMIMOProxyRegistry.sol
2: pragma solidity ^0.8.4;

https://github.com/code-423n4/2022-08-mimo/blob/main/contracts/proxy/interfaces/IMIMOProxyRegistry.sol

[NC-02] Empty receive function

The function should revert if the intention is not to receive ether, or add a functionality for the received ether.

File: contracts/proxy/MIMOProxy.sol
38: receive() external payable {}

https://github.com/code-423n4/2022-08-mimo/blob/main/contracts/proxy/MIMOProxy.sol#L38