QA Report

[code423n4]

LOW

1. Open TODO it seems that the logic is not finished and the logic might not be as expected.

• AMM.sol#L142
• AMM.sol#L555
• MarginAccount.sol#L277
• ClearingHouse.sol#L172

2. It seems that use an outdated version of openzeppelin

"@openzeppelin/contracts": "4.2.0",
"@openzeppelin/contracts-upgradeable": "4.3.2",

3. The modification process of an owner is a delicate process, since the governance of our contract and therefore of the project may be at risk, for this reason it is recommended to adjust the owner’s modification logic, to a logic that allows to verify that the new owner is in fact valid and does exist.
   It's mandatory to create a logic of the owner’s modification where a new owner is proposed first, the owner accepts the proposal and, in this way, we make sure that there are no errors when writing the address of the new owner.

• Governable.sol#L16-L20

4. The following contracts use Governable and can be paused, so a denial of service could happend if the keys are compromised or the issue number 3 happens.

• HubbleBase.sol#L15
• VUSD.sol#L11

5. There are a lack of input checks around the contracts:

• Registry.sol#L19-L23
• Never should be 0 in VUSD.sol#L74
• 1 could be abused in Oracle.sol#L170-L171
• Is not checked that the input was already added in ClearingHouse.sol#L340-L341

6. The current lock logic does not contemplate ERC20 tokens with fee during the safeTransferFrom, therefore, the amount received by VUSD will be less than the expected.
   Some tokens may implement a fee during transfers, this is the case of USDT, even though the project has currently set it to 0. So, the transferFrom function would return 'true' despite receiving less than expected.

• VUSD.sol#L44-L45
• VUSD.sol#L62-L63

7. Wrong logic around the method processWithdrawals

The logic is while (i < withdrawals.length && (i - start) <= maxWithdrawalProcesses) {

If maxWithdrawalProcesses=0 and start=0 then i=0. So (0-0)<=0 == true
But the expected maxWithdrawalProcesses is zero.

[atvanguard]

1 issue is a duplicate of #21 , disputing the rest.

[moose-code]

https://github.com/OpenZeppelin/openzeppelin-contracts/releases upgrading open zeppelin can be considered. Its good