Tests are broken

[code423n4]

Handle

kenzo

Vulnerability details

Tests have not been changed after changes to protocol.
Not much use in tests if not keeping them up to date.

Impact

Can't test protocol working correctly. (And indeed, basic mint functionality is broken, see issue).

Proof of Concept

Run the tests, they are failing.

Tools Used

Recommended Mitigation Steps

Basket's "Should allow changing the publisher after a timelock": now txs won't be reverted when given new publisher which is different then pending publisher but will set it as pending publisher.
https://github.com/code-423n4/2021-10-defiprotocol/blob/main/contracts/test/Basket.test.js#L122
https://github.com/code-423n4/2021-10-defiprotocol/blob/main/contracts/test/Basket.test.js#L125
You will also need to change the amount of mined blocks if you simply comment out the above lines. However you might want to add a test that checks the changing publisher functionality.
https://github.com/code-423n4/2021-10-defiprotocol/blob/main/contracts/test/Basket.test.js#L126

Errors which are not fully dependent on tests but on code also:

• mint's nonReenterant issue (see issue)
• publishNewIndex with empty arrays: the tests pass empty arrays to publish the new index, but as now publishNewIndex first of all checks validateWeights, the tests are failing. This also means that the publisher will need to give "mock" tokens/weights to the function, maybe a little more hassle. You can decide for example to call validateWeights(_tokens, _weights) only if you're gonna set these as pending, not if you're gonna call startAuction.
  validateWeights checks lists are not empty:
  https://github.com/code-423n4/2021-10-defiprotocol/blob/main/contracts/contracts/Basket.sol#L64
  publishNewIndex calling validateWeights initially:
  https://github.com/code-423n4/2021-10-defiprotocol/blob/main/contracts/contracts/Basket.sol#L64
  Test passes [] as parameter to publishNewIndex (and expects it to work):
  https://github.com/code-423n4/2021-10-defiprotocol/blob/main/contracts/test/Basket.test.js#L166

[GalloDaSballo]

Technically out of scope, but we'll allow