QA Report

[code423n4]

1. In the contest docs, it is specifically mentioned that: “Note that you cannot submit a project with no total budget. Therefore it requires at least one task with a budget > 0.”

However, it is indeed possible to submit a project with a total budget of 0. Observe the following passing test cases:

projectTests.ts

it('is able to add task with 0 budget', async () => {
    const hashArray = ['0x'];
    const costArray = [0]; // 0 total cost
    taskList.push(0);
    const data = {
      types: ['bytes[]', 'uint256[]', 'uint256', 'address'],
      values: [
        hashArray,
        costArray,
        await project.taskCount(),
        project.address,
      ],
    };
    const [encodedData, signature] = await multisig(data, [signers[0]]);

    const tx = await project.addTasks(encodedData, signature);
    await expect(tx)
      .to.emit(project, 'TasksAdded')
      .withArgs(costArray, hashArray);

    expect(await project.taskCount()).to.equal(1);
    const { cost, subcontractor, state } = await project.getTask(1);
    expect(cost).to.equal(costArray[0]);
    expect(subcontractor).to.equal(ethers.constants.AddressZero);
    expect(state).to.equal(1);
  });

communityTests.ts (edit createTasks in projectHelpers.ts so costArray is [0,0,0])

it('should publish project with 0 budget', async () => {
      apr = 10;
      const communityId = 1;

      expect(await project.projectCost()).to.eq(0); //indeed 0 budget

      const data = {
        types: ['uint256', 'address', 'uint256', 'uint256', 'uint256', 'bytes'],
        values: [
          communityId,
          projectAddress,
          apr,
          publishFeeAmount,
          (await communityContract.communities(communityId)).publishNonce,
          sampleHash,
        ],
      };

      const [encodedData, signature] = await multisig(data, [
        community1Owner,
        signers[0],
      ]);

      const tx = await communityContract.publishProject(encodedData, signature);

      await expect(tx)
        .to.emit(communityContract, 'ProjectPublished')
        .withArgs(
          communityId,
          projectAddress,
          apr,

          publishFeeAmount,
          publishFeeAmount.gt(0) ? false : true,
          sampleHash,
        );

      const [
        projectApr,
        projectLendingNeeded,
        projectTotalLent,
        publishFee,
        publishFeePaid,
      ] = await communityContract.projectDetails(communityId, projectAddress);

      expect(projectApr).to.be.equal(apr);
      expect(projectLendingNeeded).to.be.equal(0);
      expect(projectTotalLent).to.be.equal(0);
      expect(publishFee).to.be.equal(publishFeeAmount);
      expect(publishFeePaid).to.be.equal(false);

      const { publishNonce } = await communityContract.communities(communityId);
      expect(publishNonce).to.equal(1);
    });

2. It is possible for a builder to maliciously siphon funds for a task using changeOrder to lower the cost of a task after it has been allocated without any sort of consent from the community (only contractors).

Perhaps include the relevant community/community owner as a signer for such a change.

3. Community.sol::849, The comment indicates that wrapped tokens are burned when they are in fact minted.

4. Myriad internal/private functions lack a prepended _:

Community.sol

• checkSignatureValidity
• claimInterest

Disputes.sol

• resolveHandler
• executeTaskAdd
• executeTaskChange
• executeTaskPay

HomeFi.sol

• mintNFT

Project.sol

• autoWithdraw
• checkSignature
• checkSignatureTask
• checkSignatureValidity
• checkPrecision

4. HomeFi.sol::200, there is no corresponding event emitted when updating the trustedForwarder in the setTrustedForwarder function.

5. Tasks.sol::146,158, These comments do not match what the corresponding functions do. These comments are copies of line 136 “Task the task being set as funded” on function fundTask.