QA Report

[code423n4]

Summary of Findings

Issue#1 : Null address check missing in setGovernance()
Issue#2 : Input validation for _maintenanceMargin missing in setParams

Details Issue#1

Title : Null address check missing in setGovernance()

Impact

Null address check is not done while setting new value of governance address, which is one of the most important parameter for controlling the protocol.

Proof of Concept

Contract : Governable.sol

function _setGovernace(address _governance) internal {
    governance = _governance;
}

Recommended Mitigation Steps

Add require statement to check for null address

require(_governance != address(0), "Zero Address")

Details Issue#2

Title : Input validation for _maintenanceMargin missing in setParams

Impact

Missing input validation for important protocol parameter maintenanceMargin
During initialization, the value for this parameter is checked, however during any subsequent update, its not checked.

Proof of Concept

Contract : ClearningHouse.sol
Function : setParams()
Line : 344

Recommended Mitigation Steps

Add input validation as used in the initialize() function in the setParams function also

require(_maintenanceMargin > 0, "_maintenanceMargin < 0");