Resolve Certik v3 Reports

packages/core/contracts/Escrow.sol

@@ -182,8 +182,20 @@ contract Escrow is IEscrow, ReentrancyGuard {
     }
 
     /**
-     * @dev Bulk payout workers
-     * Should fail if any of the transaction is failing.
+     * @notice Bulk payout workers
+     * Escrow needs to be complted / cancelled, so that it can be paid out.
+     * Every recipient is paid with the amount after reputation and recording oracle fees taken out.
+     * If the amount is less than the fee, the recipient is not paid.
+     * If the fee is zero, reputation, and recording oracle are not paid.
+     * Payout will fail if any of the transaction fails.
+     * If the escrow is fully paid out, meaning that the balance of the escrow is 0, it'll set as Paid.
+     * If the escrow is partially paid out, meaning that the escrow still has remaining balance, it'll set as Partial.
+     *
+     * @param _recipients Array of recipients
+     * @param _amounts Array of amounts
+     * @param _url URL of the results
+     * @param _hash Hash of the results
+     * @param _txId Transaction ID
      */
     function bulkPayOut(
         address[] memory _recipients,
@@ -229,11 +241,17 @@ contract Escrow is IEscrow, ReentrancyGuard {
         ) = finalizePayouts(_amounts);
 
         for (uint256 i = 0; i < _recipients.length; ++i) {
-            _safeTransfer(_recipients[i], finalAmounts[i]);
+            if (finalAmounts[i] > 0) {
+                _safeTransfer(_recipients[i], finalAmounts[i]);
+            }
         }
 
-        _safeTransfer(reputationOracle, reputationOracleFee);
-        _safeTransfer(recordingOracle, recordingOracleFee);
+        if (reputationOracleFee > 0) {
+            _safeTransfer(reputationOracle, reputationOracleFee);
+        }
+        if (recordingOracleFee > 0) {
+            _safeTransfer(recordingOracle, recordingOracleFee);
+        }
 
         balance = getBalance();
 

packages/core/contracts/HMToken.sol

@@ -82,9 +82,9 @@ contract HMToken is HMTokenInterface, Ownable {
 
         if (_allowance != MAX_UINT256) {
             // Special case to approve unlimited transfers
-            allowed[_spender][msg.sender] = allowed[_spender][msg.sender].sub(
-                _value
-            );
+            allowed[_spender][msg.sender] =
+                allowed[_spender][msg.sender] -
+                _value;
         }
 
         emit Transfer(_spender, _to, _value);
@@ -125,11 +125,11 @@ contract HMToken is HMTokenInterface, Ownable {
             _oldValue + _delta < _oldValue || _oldValue + _delta == MAX_UINT256
         ) {
             // Truncate upon overflow.
-            allowed[msg.sender][_spender] = MAX_UINT256.sub(1);
+            allowed[msg.sender][_spender] = MAX_UINT256 - 1;
         } else {
-            allowed[msg.sender][_spender] = allowed[msg.sender][_spender].add(
-                _delta
-            );
+            allowed[msg.sender][_spender] =
+                allowed[msg.sender][_spender] +
+                _delta;
         }
         emit Approval(msg.sender, _spender, allowed[msg.sender][_spender]);
         return true;
@@ -149,9 +149,9 @@ contract HMToken is HMTokenInterface, Ownable {
             // Truncate upon overflow.
             allowed[msg.sender][_spender] = 0;
         } else {
-            allowed[msg.sender][_spender] = allowed[msg.sender][_spender].sub(
-                _delta
-            );
+            allowed[msg.sender][_spender] =
+                allowed[msg.sender][_spender] -
+                _delta;
         }
         emit Approval(msg.sender, _spender, allowed[msg.sender][_spender]);
         return true;