QA Report

[code423n4]

L-01 : Change admin in 2 steps

Code:
https://github.com/code-423n4/2022-08-rigor/blob/5ab7ea84a1516cb726421ef690af5bc41029f88f/contracts/HomeFi.sol#L157

`function  replaceAdmin(address _newAdmin)

external

override

onlyAdmin

nonZero(_newAdmin)

noChange(admin, _newAdmin)

{

// Replace admin

admin = _newAdmin;

  

emit  AdminReplaced(_newAdmin);

}

I recommend changing admin in 2 steps to prevent setting wrong address as admin.

Proof of Concept : Change to new address

function  replaceAdmin(address _newAdmin)

external

override

onlyAdmin

nonZero(_newAdmin)

noChange(admin, _newAdmin)

{

// Replace admin

NewAdmin = _newAdmin//@audit: NewAdmin is another state variable

  

emit  AdminReplaced(_newAdmin);

}

Claim new Address

function claimAdmin (address _admin) external

override

onlyAdmin

nonZero(_newAdmin)

noChange(admin, _newAdmin){
require(_newAdmin ==NewAdmin ); // @dev: Ensures we enter correct address we intend to make admin
admin = _newAdmin;
}

Similar action is recommended for changing Treasury in HomeFi.sol.

L-02: Admin can change fees to any arbitrary amount

Instance:
https://github.com/code-423n4/2022-08-rigor/blob/5ab7ea84a1516cb726421ef690af5bc41029f88f/contracts/HomeFi.sol#L185

function  replaceLenderFee(uint256 _newLenderFee)

external

override

onlyAdmin

{

// Revert if no change in lender fee

require(lenderFee != _newLenderFee, "HomeFi::!Change");

  

// Reset variables

lenderFee = _newLenderFee;

  

emit  LenderFeeReplaced(_newLenderFee);

}

I recommend setting any limit to the fees that admin can set.