QA Report

[code423n4]

1. There are a lack of input checks around the contracts:

• DepositHook.sol#L14
• DepositHook.sol#L40
• WithdrawHook.sol#L30
• Collateral.sol#L48-L49
• PrePOMarket.sol#L45-L48
• SingleStrategyController.sol#L75
• Collateral.sol#L229
• Collateral.sol#L238

2. Methods and code without comments. Comments are missing which makes review difficult and reduces the quality of the code.
3. Logic prone to reentrancy errors. When the amount exceed the total allowed to withdraw, instead of fault the transaction it set the amount to 0.

• CollateralDepositRecord.sol#L49
• CollateralDepositRecord.sol#L54

4. The use of clearAllowedAccounts should force to change the _root, otherwise the users can use allowSelf to be allowed again.

• AccountAccessController.sol#L68

5. Some methods doesn't check the result of the approve, transfer and transferFrom calls. ERC20 standard specify that the token can return false if the transfer was not made, so it's mandatory to check the result of this calls.

• PrePOMarket.sol#L121
• PrePOMarket.sol#L123
• PrePOMarket.sol#L168
• PrePOMarket.sol#L170
• SingleStrategyController.sol#L60
• SingleStrategyController.sol#L62
• Collateral.sol#L76

6. In PrePOMarketFactory Is not checked that _deployedMarkets[_salt] already exists, so a possible collision could occur and change the stored market entry.

• PrePOMarketFactory.sol#L77

7. Use delete instead of set to default value (false or 0)

• Collateral.sol#L107-L108
• Collateral.sol#L133-L134

[ramenforbreakfast]

1 and 2 are too vague for me to consider as valid submissions.
3 needs to demonstrate how such a situation would occur.
4 is not an issue, this is why we have setRootAndClearAllowedAccounts to perform this atomically.
5 is a duplicate of #4.
6 is a duplicate of #2.
7 is a minor change and does not explain the benefits of doing this.