Skip to content

Latest commit

 

History

History
175 lines (106 loc) · 4.62 KB

report.md

File metadata and controls

175 lines (106 loc) · 4.62 KB

Aderyn Analysis Report

This report was generated by Aderyn, a static analysis tool built by Cyfrin, a blockchain security company. This report is not a substitute for manual audit or security review. It should not be relied upon for any purpose other than to assist in the identification of potential security vulnerabilities.

Table of Contents

Summary

Files Summary

Key Value
.sol Files 2
Total nSLOC 350

Files Details

Filepath nSLOC
src/PoolFactory.sol 35
src/TSwapPool.sol 315
Total 350

Issue Summary

Category No. of Issues
Critical 0
High 0
Medium 1
Low 1
NC 3

Medium Issues

M-1: Using ERC721::_mint() can be dangerous

Using ERC721::_mint() can mint ERC721 tokens to addresses which don't support ERC721 tokens. Use _safeMint() instead of _mint() for ERC721.

  • Found in src/TSwapPool.sol Line: 193

             _mint(msg.sender, liquidityTokensToMint);

Low Issues

L-1: PUSH0 is not supported by all chains

Solc compiler version 0.8.20 switches the default target EVM version to Shanghai, which means that the generated bytecode will include PUSH0 opcodes. Be sure to select the appropriate EVM version in case you intend to deploy on a chain other than mainnet like L2 chains that may not support PUSH0, otherwise deployment of your contracts will fail.

  • Found in src/PoolFactory.sol Line: 15

     pragma solidity 0.8.20;

  • Found in src/TSwapPool.sol Line: 15

     pragma solidity 0.8.20;

NC Issues

NC-1: Functions not used internally could be marked external

  • Found in src/TSwapPool.sol Line: 296

         function swapExactInput(

NC-2: Constants should be defined and used instead of literals

  • Found in src/TSwapPool.sol Line: 274

             uint256 inputAmountMinusFee = inputAmount * 997;

  • Found in src/TSwapPool.sol Line: 276

             uint256 denominator = (inputReserves * 1000) + inputAmountMinusFee;

  • Found in src/TSwapPool.sol Line: 292

                 ((inputReserves * outputAmount) * 10000) /

  • Found in src/TSwapPool.sol Line: 293

                 ((outputReserves - outputAmount) * 997);

  • Found in src/TSwapPool.sol Line: 403

                 outputToken.safeTransfer(msg.sender, 1_000_000_000_000_000_000);

  • Found in src/TSwapPool.sol Line: 455

                 1e18,

  • Found in src/TSwapPool.sol Line: 464

                 1e18,

NC-3: Event is missing indexed fields

Index event fields make the field more quickly accessible to off-chain tools that parse events. However, note that each index field costs extra gas during emission, so it's not necessarily best to index the maximum allowed per event (three fields). Each event should use three indexed fields if there are three or more fields, and gas usage is not particularly of concern for the events in question. If there are fewer than three fields, all of the fields should be indexed.

  • Found in src/PoolFactory.sol Line: 35

         event PoolCreated(address tokenAddress, address poolAddress);

  • Found in src/TSwapPool.sol Line: 52

         event LiquidityAdded(

  • Found in src/TSwapPool.sol Line: 57

         event LiquidityRemoved(

  • Found in src/TSwapPool.sol Line: 62

         event Swap(